Systems and methods for providing visibility to SS7 integrated on-line networks

ABSTRACT

A system and method capture data from an SS7 network and pair each invoke message with its corresponding response message. Each message is stored in a daily file as well as in a table dedicated for that particular message type. A separate file is also maintained on each MIN and holds the most current registration information for each MIN. The system and method support four different types of queries: a MIN/ESN query, an active roamer query, a switch-to-switch query, and a transaction statistics query. The MIN/ESN query provides roaming activity on a specific MIN or ESN while the active roamer query provides information on all roamers in a serving market. The switch-to-switch query reveals messaging at one switch or between two switches. The statistics query provides data to a provider on all of its subscribers roaming in foreign networks or on all phones within its own network. The system has a Graphical User Interface (GUI) for displaying information on each message in an easy and convenient manner. The details of a record are displayed in a tabular format with each tab holding data for a group of parameters.

This application is a continuation of U.S. Ser. No. 10/140,455, filedMay 7, 2002, now U.S. Pat. No. 7,027,809, which is a continuation ofU.S. Ser. No. 09/135,519, filed Aug. 17, 1998, now U.S. Pat. No.6,501,950, which is a continuation-in-part of U.S. Ser. No. 08/615,962,filed Mar. 14, 1996, now U.S. Pat. No. 6,014,557.

FIELD OF THE INVENTION

The present invention relates in general to the field oftelecommunications and in particular to the field of wirelesstelecommunications systems administration, fraud detection, customerservice, engineering support, and technical support.

BACKGROUND OF THE INVENTION

The market for telecommunications services has grown at an extraordinarypace, and perhaps the greatest growth has occurred in the market forwireless communications, including cellular networks and personalcommunication systems.

Conventional wireless telecommunication systems employ numerousindependent cellsites (“cells”). Each cell covers a designatedgeographic area and is connected via a dedicated network (usually leasedlines or microwave) to a Mobile Switching Center (“MSC”) that is in turnconnected to the Public Switched Telephone Network (“PSTN”). The MSChandles all call processing intelligence, switching functionality, faultdetection and diagnostics. MSCs are also integral to the operation ofrecently developed Personal Communication Systems (“PCSs”), another typeof wireless system. A PCS utilizes numerous “microcells” that blanket ahigh use area, or an area where terrain features limit transmissioncapabilities (e.g., a downtown office district with tall buildings.)Because of the greater number of cells, the PCS can handle asignificantly greater volume of traffic. Located within each PCSmicrocell is a low power transmitter. After receiving the subscriber'ssignal, the low power transmitter communicates (normally via microwave,PSTN, or data lines) with a controller. The controller, in turn,communicates with the MSC. Each PCS or cellular network covers only aspecified “home” geographic area. Consequently, as the mobile user movesout of the home area and into a “foreign” area, telecommunicationsservice is provided by a “foreign” wireless service provider typicallynot associated with the user's home wireless service provider. Operationin a foreign area is known as “roaming.”

The deployment of Signaling System No. 7 (“SS7”) networks for wirelesssystems like PCs or cellular networks has permitted carriers to supply anumber of new applications to wireless systems' customers. SS7 is ahighly flexible common channel signaling standard specifically designedfor providing circuit and database related message flow control innetworks. The feature enhancements to services made possible SS7 haveaccelerated its deployment. But most cellular systems continue to useservices furnished by outside network providers. The high price of thoseservices has tended to lead wireless services providers to deploy theirown SS7 networks.

The fees associated with the use of network services provided by thirdparties, which may be charged on a per transaction basis, lead to higherconsumer prices for wireless communications services. The cost of payingnetwork providers to operate a SS7 or other network, and the consumerprices they result in, may represent a serious constraint on wirelessgrowth. An additional impediment to growth in the market for wirelessservices is the absence of a seamless roaming environment. In a seamlessroaming environment, enhanced communications services are provided tomobile subscribers as they move about the nation (or, moreoptimistically, through various parts of the world), without diminutionin service as one crosses boundaries between service providers.

Fraudulent uses of wireless systems pose an even greater threat togrowth of wireless communications. For example, industry fraud lossesexceeded an estimated four hundred million dollars in 1994.

Geographic expansion of services permitted by the creation of anationwide network has accelerated the already significant cellularfraud. The incidence of fraud has significantly worsened as carriersallow users to make calls from anywhere in the country. Losses for 1995are estimated at over one and a half million dollars per day. Growth infraud losses for the first time exceeds industry growth.

Indeed, some wireless service providers have been forced by theoverwhelming costs of fraud to suspend roaming service in foreign areaswhere its incidence is high. Preventing or minimizing the fraudulent useof wireless systems is therefore a necessary precondition to putting theindustry back on a solid growth track and developing a nationwidenetwork providing seamless roaming.

Two types of fraud are prevalent. One is “cloning fraud,” in which avalid customer's mobile identification number (“MIN”) and/or electronicserial number (“ESN”) are “cloned” or copied into another cellular set.Most typically, cloning fraud is perpetrated in a foreign serviceprovider's network. Even when the fraud occurs outside of the homeservice provider's network, the home service provider remains liable forthe fraud, the costs of which directly diminish the service provider'srevenue.

A second typical fraud problem involves subscribers who are not entitledto service (e.g., because they have failed to pay their bills orobtained service under false identities, etc.), but who neverthelessattempt to obtain roaming service in a foreign service provider'swireless system. Roaming involves a validation process to determine ifthe roamer is legitimate in its home system. The switches of systemslocated geographically close to one another are often coupled becausethose systems' customers will frequently roam into the adjacent area.These systems can directly communicate with one another to exchangevalidation requests and fraud control data. In any event, even if someswitches of different systems were coupled, those switches maynevertheless be unable to communicate with one another to exchangevalidation requests and fraud control data for the simple reason thatthe switches may be incompatible with one another. As a result, anational clearinghouse system for handling fraud and roamer managementhas arisen.

A national clearinghouse typically has a database containing so called“negative files” including lists of stolen phones and cloned MINs. Thetypical clearinghouse also couples to the MSCs of subscribing systems inorder to access subscriber data, usually called the HLR or Home LocationRegister, to validate subscribers for whom services are being requestedin a foreign market whose service provider is also a member of theclearinghouse network. A national clearinghouse is capable of providingon-line support as well as a data feed. The clearinghouse validatescustomers prior to allowing a request for telecommunications service toproceed. But by the time the clearinghouse checks its own database andthen, if necessary, the database of the subscriber's carrier, theforeign carrier may already have permitted a fraudulent roamingcommunication to occur.

In order to detect “cloning fraud,” a service provider may use, amongother methods, a fraud management system that develops usage profiles.These profiles are based on the communications traffic information forparticular customers and are obtained from billing records and othersources. If a call does not match the customer's profile, an analyst maycontact the customer. A fraud detection system (like CloneDetectoravailable from GTE TSI (Telecommunications Services Inc.)) analyzescalling patterns to identify calls made close in time using identicalMINs in widely-separated geographical areas. This type of conditiongenerally indicates that one of the MINs is a clone. The customercorresponding to the MIN is contacted for confirmation and appropriatesteps are taken to lock the clone out of the system.

Some clearinghouses are presently attempting to offer both frauddetection systems and customer on-line support systems intended to reactin real time. Clearinghouses charge each subscribing service provider aper-transaction fee for providing fraud management services and alsocharge for certain on-line support data. In addition to chargingtransaction fees, clearinghouses incorporate each subscribing serviceprovider's valuable and commercially sensitive customer information intoa central pool within its exclusive control. Clearinghouses provideneeded roamer visibility. But subscribing service providers lose theability to obtain data on their own network transactions if they choosenot to utilize the clearinghouses for validation for particulartransactions. Data of this sort is critical, not only for networkoperation, but also for purposes of planning and marketing.Understandably, subscribing service providers also prefer to maintaincontrol over their own customer profile and system traffic information.They thus prefer to eliminate the clearinghouse service and directlymanage user validation for their own networks in order to eliminate thetransaction fees charged by the clearinghouses and obtain their ownon-line support data.

Subscribing service providers can circumvent the clearinghouse servicesby networking their switches with switches in foreign service providers'systems. This process is facilitated by deployment of SS7 networks,coupled with the advent of IS-41. IS-41 is an interim standard createdby the Electronic Industry Association/Telecommunications IndustryAssociation (“EIA/TIA”) that permits switches produced by differentmanufacturers to communicate with one another. IS-41 enables the switchof a home system of a roaming subscriber to communicate with a foreignsystem providing services to the roaming subscriber in order to transmitvalidation and customer profile information. IS-41 messages may betransported over SS7 networks that many service providers are alreadyconnected with or soon will be deploying. Other standards may bedeveloped and will likely also be capable of transmission over SS7networks. Using such standard message formats and protocols, switchesbelonging to differing service providers become capable of requestingvalidation data and exchanging customer profile information. Thisinformation sharing not only eliminates the high transaction chargesassociated with a national clearinghouse, but it also returns control ofvaluable, proprietary customer profile information to the serviceproviders.

Since many such fraud detection systems (such as GTE's) obtain fraudcontrol and customer support data feeds from links between an individualMSC and clearinghouse, as wireless service providers connect theirswitches directly using SS7 or another network, the data trafficoccurring between such interconnected switches is no longer “visible” tothe clearinghouse system. In other words, clearinghouse systems oftencannot obtain information on transactions involving wireless serviceproviders whose switches are coupled directly to each other via the SS7network.

Obviously, this is a problem that directly impedes clearinghousesability to provide accurate and comprehensive fraud control and customersupport data. The problem will accelerate as more service providersinterconnect via SS7 or other networks. Such interconnections willincrease as service providers take advantage of the flexibility of theSS7 network and new standards like IS-41 in order to interconnectdirectly with other service providers in adjacent geographic regions orin high use metropolitan areas frequented by business or touristtravelers.

Further, with the advent of SS7 networks, future service enhancementsare likely. Those enhancements should be provided without disruptingfraud data feeds and other customer service operations; current systemsdo not eliminate or minimize disruptions, however.

As wireless service providers link their switches and move toward anationwide network, “they will bypass the traditional methods ofcapturing roamer messages. They will have to assume more responsibilityfor insuring that the systems they use provide the required level ofmessage visibility to maintain superior customer service and roamermanagement—especially as more customers are roaming and using additionalenhanced services.” Rolando Espinosa, “The Industry's Most ImportantChallenge: Cellular Signaling Network Management,” Telephony, Vol. 227at 27 (Aug. 22, 1994.) The ongoing and projected future conversion toSS7 networks therefore requires new methods and systems to extract fraudcontrol and customer support information.

Even for service providers that may not adopt the SS7 or other standardnetwork protocols, fraud control and customer on-line support systemsfurnished by outside providers suffer from drawbacks, both technical andfinancial. Among their technical shortcomings, the systems may notprovide the full fraud data feeds necessary for minimizing and managingnetwork fraud. Nor do the systems provide complete message“visibility”—information on transactions with some of the carrier'sclosest roaming partners may not be obtained and transmitted to eitherthe fraud control or customer support systems. Financially, reliance onoutside network providers for fraud control and customer support systemscosts service providers significant ongoing transaction fees.

Service providers face other difficulties which are only aggravated asthey interconnect their switches to the switches of other serviceproviders. Customer service, for example, is one aspect of operating awireless network that becomes more of a challenge when subscribers roaminto other service areas. Even when a subscriber has difficulty withinthe service provider's home network, isolating the source of the problemmay take days or even weeks. The problem, for instance, could be withthe subscriber's phone, with a particular switch within the provider'snetwork, with the subscriber's billing system, or with a Home LocationRegister (HLR). Locating the problem is often accomplished through aprocess of elimination. When the problem occurs when the subscriber isroaming, the possible sources of the fault are compounded and additionaltime and expense may be incurred before the problem can be detected andcorrected.

The difficulty in providing customer service is endemic of a largerdifficulty in maintaining a service provider's network. Even when thesource of the problem is known, such as a particular switch within thenetwork, identifying and correcting the precise problem is often not aneasy task. For a switch, the service provider must dispatch personnel tothe switch so that they can monitor the operations of the switch. Thepersonnel then try to replicate events that triggered the problem orfault in the hopes that they can detect the source of the fault. Ingeneral, the engineering and technical support personnel react to theproblems and are often unable to stop problems before they occur.Additionally, the engineering and technical support personnel attempt toisolate and correct problems by monitoring future activity of thenetwork and do not have clear records as to what occurred in the past atthe time of the problem.

As discussed above, the advent of IS-41 allows greater communicationbetween switches, especially between switches of two different serviceproviders. The IS-41 messages transmitted and received by a serviceprovider contains information about its network and subscribers and canbe extremely valuable to the service provider. The service provider,however, is typically unable to capture the value in these messagessince a single service provider have hundreds of thousands of thesemessages passing through its network each day. With such a large volumeof messages, a service provider cannot easily extract useful informationfrom the messages and the potential value in the messages is notcaptured.

SUMMARY OF THE INVENTION

According to one aspect, the present invention provides apparatus andmethods for capturing information relating to communications trafficfrom one or more wireless telecommunications systems, and for processingthe captured information at a message processor to produce roamervisibility and fraud data useful in administering such systems. Amonitoring and data capture platform or subsystem monitors each of thetelecommunications links coupling a Mobile Switching Center (“MSC”) ornetwork elements like Signal Transfer Points or particular types of MSCsdirectly. This data capture subsystem may be configured to captureselected data pertaining to wireless telecommunications, including anynumber of desired call control and processing messages, depending on thetype of data desired for roamer visibility, fraud control engineering,customer support or other functions of importance to wireless serviceproviders, whether they provide cellular, PCS or other wirelesscommunications network services. The selected data, typically in theform of messages in an operative protocol (e.g., the IS-41 protocol),can then be buffered for analysis or transmission. The selected data canbe formatted and transmitted to (1) a message processor subsystem forfurther processing or (2) directly to a fraud system, customer supportsystem, or other administrative instrumentality for further analysis oruse.

Similarly, a method associated with the data capture apparatus furnishesvisibility and/or fraud data relating to wireless communications basedon related message traffic. Signals pass through various networkelements like a Signal Transfer Point (“STP”) pair or switch and aretransmitted over at least one telecommunication network link coupled toat least one wireless switching center. A data capture device is coupledto at least one of the links or one of the network elements. Links ornetwork elements are monitored for messages of interest, such as amessage belonging to a preselected (and changeable) set of messagetypes.

According to the method, signals containing messages relating towireless telecommunications traffic are read off of at least one of thetelecommunications links. Messages pertaining to wireless traffic areidentified, and, of these messages, those belonging to a preselected(but changeable) set of message types are selected. Selected messagesare then forwarded to an administrative instrumentality. Theadministrative instrumentality may be a message processor that furtherprocesses messages received from a plurality of data capture devices tocollate messages or filter out from the incoming data stream messagesredundant to those already provided by an outside source. Alternatively,message processing can be done at the data capture device and messagesforwarded directly to other administrative instrumentalities like afraud detection system, customer on-line support station or any otherend-user capable of operating upon the captured messages.

In an illustrative embodiment of a system according to the presentinvention, the data capture subsystem is configured to transmit theselected data to a message processor for further processing to yielduseful visibility and fraud data. (Generally, “visibility data” iswireless system data that identifies subscriber roaming activity betweenwireless systems. An example of some of the visibility data generated isthe location and system usage of roaming subscribers.) The messageprocessor stores selected incoming messages from the data capturesubsystem in a memory location. The message processor then collatesreceived messages with the stored messages to provide roamer visibility,fraud, or other useful administrative data. This data may be madeavailable for query by on-line customer support workstations that maydisplay the forwarded data on a real-time basis. Additionally, themessage processor processes incoming captured messages and extractscertain data for transmission to a fraud detection or control system inthe form of a data feed, for example.

A data capture portion of an embodiment of the present invention thusgenerates a set of wireless telecommunications visibility and/or frauddata based on messages transmitted over at least one telecommunicationslink or through various network elements. The visibility or fraud datais for use by an instrumentality in monitoring, servicing or otherwiseadministering a wireless telecommunications system.

One embodiment of a data capture apparatus comprises a link capturedevice that includes at least one telecommunications link interface;each link interface corresponds and couples to a telecommunications linkfor reading signals off the link. A processor may be coupled to the linkinterface and may be programmed for any of the following tasks:retrieving signals read by the telecommunications link interface;identifying messages in the retrieved signals; selecting messagesbelonging to a preselected set of message types of interest; andformatting the selected messages for transmission to the administrativeinstrumentality.

Alternative embodiments of data capture apparatus exist for capturingmessages of interest from message traffic in wireless systems.

For example, rather than read messages off of telecommunications links,message traffic through a Signal Transfer Point (“STP”) can be directlymonitored and messages of interest captured. Preprocessors provided foreach of a pair of STPs read appropriate message traffic and, afterreformatting, forward selected captured messages to a merge processor.The merge processor combines captured messages and forwards them to themessage processor.

Alternatively, for MSCs (particularly those manufactured by AT&T)operating with a proprietary protocol (AT&T's protocol is called EFTN)the proprietary intra-switch messages can be “translated” to a standardformat (e.g., IS-41). A switch message capture device, implemented in aseparate processor or resident on a portion of the message processor,can obtain from the switch “translated” proprietary messagescorresponding to messages of interest passing through, translated at andbuffered at the switch. (To translate EFTN a software package may beobtained from AT&T and deployed at the switch of interest.) Capturedmessages are then transferred to an appropriate other portion of themessage processor. (Absent this alternative embodiment of data capturedevice, messages in AT&T's proprietary EFTN format would not be capturedsince other data capture devices could not recognize the messages ofinterest given their proprietary format.)

A message processor may generate system fraud and roamer visibility datafor use by a service provider in administering its wireless systems anddetecting fraud. A portion of the message processor is in communicationwith at least one data capture device (as described herein), or otherdevice, for capturing from a wireless system messages indicative ofwireless system traffic, the messages corresponding to a number ofclasses. As an example, there may be a first class of “challenge”messages and a second class of “response” messages; these may be typicalof any system that uses a query/response (or “ACK”/“NACK”) certifieddelivery method. In wireless systems using IS-41 protocol, the firstclass of challenge messages would be an “invoke” message; the secondclass of response messages would be a return result messages.

At least one input port on the message processor may receive messagespertaining to wireless traffic from the data capture device or, if themessage processor is centrally located, a plurality of data capturedevices. The message processor may be coupled to at least one memorylocation. (The phrase “memory location” means a memory or data storagedevice of any sort, or a portion of such a device.) The messageprocessor is programmed to: receive messages indicative of wirelesstraffic from a data capture device and store in the memory locationreceived messages that belong to the first class. For each receivedmessage belonging to the second class, the message processor searchesthe memory location for a previously stored first class of messagerelated to the received message. If any message located in the search isrelated to the received message of the second class, the messageprocessor collates the received message with the located message, andprovides the collated messages to an end-user or a processor.

A method associated with processing captured messages includes:receiving messages indicative of wireless traffic from the data capturedevice; storing the received messages belonging to a first class ofmessage (e.g., IS-41 invoke messages) in the memory location; for eachreceived message belonging to a second class (e.g., IS-41 return resultmessages), searching the memory location for a previously stored messageof the first class related to the received message and, if any messagelocated in the search of the memory location is related to the receivedmessage of the second class, collating the received message with thelocated message. Finally, the collated messages are provided to anend-user. Optionally, collated messages may be “filtered” to eliminatethose messages already being provided by a third party fraud or customersupport system.

Generally, the message processor may be centrally located and incommunication with various data capture devices via a LAN, WAN orequivalent communication path. Central location allows for easierchanges to the functionality implemented by the message processor.Nevertheless, the message processor may also be deployed with andconnected directly to each data capture device. This would free upvaluable system bandwidth since raw, unprocessed messages will not besent, as is the case with a centrally located message processor.

A system for capturing desired messages from a wireless system that usesa preselected signaling system and preselected protocol thus includesdata capture devices that (i) monitor wireless system message trafficthrough various network elements or across at least one networktelecommunications link and (ii) select from the monitored messagesthose corresponding to a preselected set of message types. The systemalso includes a message processor coupled by a transmission path ordirectly to the data capture device(s) and programmed to collateselected messages with one another to produce records associated withthe wireless telecommunications traffic, as well as means for providingsuch records to an end-user.

Indeed, if desired, the present invention could be used not only tocapture messages of interest but also to monitor for messages ofinterest. Tallies of messages of interest could then be processed tocreate various statistics relevant to network traffic and extremelyhelpful to network engineering or customer support and marketing.

Accordingly, the present invention provides visibility data at a lowcost as well as data to maintain or improve the effectiveness ofexisting fraud detection systems. Adopting the present invention avoidsinterrupting fraud investigation if the wireless system replaces an X.25or any other existing network, including a SS7 network operated by anoutside network provider, with its own SS7 or other network. Using thepresent invention, fraud control systems can be deployed in othermarkets without relying on third-party network operators and withoutlosing roamer visibility when a carrier utilizes a selected protocol,such as SS7, to transport validation transactions. Presently deployedwireless systems will enjoy enhanced productivity benefits flowing fromthe provision of more detailed, yet real time, customer support, networktraffic engineering or other administrative information. By implementingthe carefully designed on-line support system, wireless providers willnevertheless receive just the right amount of data of interest, thusoptimizing use of valuable system bandwidth.

According to another embodiment of the invention, a system includes acatcher for receiving data from data capture devices. A parser reads thedaily files and interprets the messages into tables and fields. If thereceived message is a registration message or a reject message, thenthese messages are preferably written into a registration daily file anda reject daily file, respectively. The messages are preferably pairedtogether so that all invoke messages are stored with the correspondingresponse message.

In the preferred embodiment, the system and method according to themethod preferably maintain a separate table for each message type and amaster daily file containing general information on all messagesreceived that day. The database is structured so that it holds a week'sworth of data, with the last day's data being deleted with each new day.The database also preferably contains a table holding the most currentregistration information on each MIN. By storing message data into aplurality of tables, responses to queries can be generated more quickly.For instance, rather than reading all of the data in a daily file todetermine the location of a particular MIN, the system and method canperform a quick look-up in the MIN table, which contains a significantlyless amount of data than the daily files. The system and methodfurthermore conserve space on the database by coding entries in thetables and fields. For instance, rather than storing “registrationnotification” when this type of message is received, the system andmethod instead store a specific number for that message, such as “38.”

The system and method support a number of different types of queries.One such query is a MIN/ESN query. With this query, the roaming activityof a specific customer can be ascertained. This search may be performedon a single day or over a range of days. A second type of query that maybe performed with the invention is an active roamer query. An activeroamer query shows a list of roamers that are active in a servingmarket. This query may be limited to a certain SID, switch, home SID, orNPA-NXX. A third query supported with the invention is aswitch-to-switch query. The switch-to-switch query provides informationon all ANSI-41 messaging on one switch or between two switches. Thesearch may be performed on a single day or a range of dates. A fourthquery performed with the invention is a transaction statistics query.The transaction statistics query provides information on registrationmessages between two cellular service providers. With this query,information may be obtained on all subscribers roaming in a foreignmarket or information may be obtained on everyone served by a homenetwork. This query can be limited to a home region, to specific dates,to a specific roaming partner, and to a particular company, SID, switch,NPA-NXX, or MIN.

From the results of any query, a user can obtain record details on anymessage. If a user double-clicks on a message in the results section,the information on that message is pulled from the message table and theinformation is displayed in a tabular format. Each tab of informationcontains data on a group of parameters. If no data exists for allparameters within a group, then that tab preferably is not displayed tothe user.

The system and method provide extremely useful data to a serviceprovider. For customer support, the service provider can more quicklydetermine the source of a customer's problem. The service provider neednot place any type of “sniffer” on a switch but instead can quicklyrecall the messaging that occurred at the time of the customer'sproblem. Customer support, for instance, can determine whether thecustomer is able to register, whether the customer is authorized for aparticular service. The engineering and technical support of a serviceprovider can determine the cause of a past problem and, by monitoringthe messaging within the network, can even prevent future problems fromoccurring.

It is accordingly an object of the present invention to provide a datacapture device for monitoring and capturing a variety of information ontelecommunications traffic within a wireless system.

It is an object of the present invention to provide a plurality of datacapture devices, some of which capture data from a telecommunicationslink, others of which are coupled to particular network elements fromwhich data of interest is captured.

It is a further object of the present invention to provide captured datato an administrative facility, such as a central message processor,where the results are collated or otherwise processed to yield roamervisibility, fraud, or other data useful in the administration of awireless system.

It is an additional object of the present invention to provide a messageprocessor for (1) receiving messages captured by data capture devicescoupled to telecommunications links or network elements in a wirelesssystem and (2) processing the received messages to yield paired IS-41 orother messages that provide roamer visibility and data useful in thedetection of fraud.

It is another object of the present invention to provide a centralmessage processor including a database containing roamer visibility dataavailable for query by one or more on-line customer support systems.

It is a further object of the present invention to provide methods andapparatus for providing a central message processor for processingcaptured messages as well as fraud data received from outside or thirdparty providers to generate a fraud data feed from which redundantfraud-related information has been removed.

It is still a further object of the present invention to provide methodsand systems for enabling useful queries to be performed based oncaptured data.

It is yet another object of the present invention to provide methods andsystems for allowing the capture of real-time roaming statistics.

It is another object of the present invention to provide methods andsystems for allowing the capture of real-time data for use byengineering or technical support.

It is still another object of the present invention to provide methodsand systems for enabling results of a query of a database to be returnedin a relatively short period of time.

Other objects, features and advantages of the present invention willbecome apparent upon reading the remainder of this document.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic illustration of the architecture of an embodimentof a system for capturing fraud and customer data relating to a wirelesstelecommunications system according to one embodiment of the presentinvention.

FIG. 2 is a schematic illustration of data flows associated with thesystem architecture illustrated in FIG. 1.

FIG. 3 is a block diagram illustrating signal links, interfaces andfunctionality of an embodiment of a data capture device and method forcapturing fraud and customer data from a wireless system according tothe present invention.

FIG. 4 is a block diagram indicating the functionality and components ofanother embodiment of a data capture device for coupling to STPs.

FIG. 5 is a block diagram and flowchart illustrating yet anotherembodiment of a data capture device that captures data from a switchusing a manufacturer's proprietary protocol.

FIG. 6A is a flowchart illustrating a first portion of the logic flowassociated with a real time decoding function implemented by a datacapture device.

FIG. 6B is a flowchart illustrating a second portion of the logic flowassociated with a real time decoding function implemented by a datacapture device.

FIG. 7A illustrates the format for a data packet carrying a messagecaptured by a data capture device.

FIG. 7B illustrates the format for a header portion of a data packetcarrying a message captured by the data capture device.

FIG. 7C illustrates the format for a data portion of a data packetcarrying a message captured by the data capture device.

FIG. 8 is a flowchart illustrating at a high level of abstraction thelogic flow of the processing performed by a central message processorillustrated in FIG. 1-3.

FIG. 9 is a flowchart illustrating the logic flow of a socket processingmodule of the logic flow illustrated in FIG. 8.

FIGS. 10A-B are flowcharts illustrating the logic flow of a “processsockets” module of the socket processing module illustrated in FIG. 9.

FIG. 11 is a flowchart illustrating the logic flow of filtering captureddata collected according to the present invention.

FIG. 12 is a flowchart showing the processing flow associated withoperating an embodiment of a customer on-line support station.

FIG. 13 is a schematic diagram of a system architecture according to asecond embodiment of the invention.

FIG. 14 is a process-table relationship diagram for the systemarchitecture of FIG. 13.

FIG. 15 is a flowchart showing a parent process performed in catchingdata captured with a data capture device.

FIG. 16 is a flowchart showing a child process, spawned by the parentprocess of FIG. 15, in catching and handling the captured data.

FIG. 17 is a flowchart showing a parent process performed in catchingdata captured at an STP.

FIG. 18 is a flowchart showing a child process, spawned by the parentprocess of FIG. 17, in catching and handling the captured data.

FIG. 19 is a flowchart showing a process of pairing message recordscaptured at the STP.

FIG. 20 is a flowchart showing a process of taking stored captured dataand parsing into tables and fields.

FIG. 21 is a flowchart showing a process of parsing message parametersperformed in the flowchart in FIG. 20.

FIG. 22 is a flowchart showing a process of creating and placing anINSERT statement into a database performed in the flowchart in FIG. 20.

FIG. 23 is a flowchart showing a process of taking reject records andparsing the records into tables and fields.

FIG. 24 is a flowchart showing a process of updating statisticalinformation based on captured data.

FIG. 25 is a flowchart showing a process of updating fields in a tableof MINs.

FIG. 26 is a flowchart depicts a process of using a GUI to go on-linewith the system of FIG. 13.

FIG. 27 is an example of a main menu for a GUI according to a preferredembodiment of the invention.

FIG. 28 is a header for use with the GUI in performing a MIN/ESNTransactions query.

FIGS. 29A and 29B are flowcharts depicting processes of performing aMIN/ESN query.

FIG. 30A is an example of a GUI showing results of a MIN/ESN query andFIGS. 30B and 30C are examples of GUIs showing details of a specificrecord in the results of FIG. 30A.

FIG. 31A is a header for use with the GUI in performing an active roamerquery and FIG. 31B is an example of the GUI showing results of an activeroamer query.

FIGS. 32A and 32B are flowcharts depicting processes of performing aroamer query.

FIG. 33A is a header for use with the GUI in performing aswitch-to-switch query and FIG. 33B is an example of the GUI showingresults of a switch-to-switch query

FIGS. 34A and 34B are flowcharts depicting processes of performing aswitch-to-switch query.

FIG. 35A is an example of a GUI for performing a Transaction Statisticsquery and FIGS. 35B to 35F are examples of GUIs showing results ofTransaction Statistics queries at various levels of specificity.

FIG. 36 is a flowchart depicting a process of performing a statisticalquery.

FIG. 37 is a flowchart depicting a process of performing a statisticalquery at a SID Level.

FIG. 38 is a flowchart depicting a process of performing a statisticalquery at an NPA-NXX/MIN level.

FIGS. 39A to 39C are GUIs showing record details of an authenticationfailure report message.

FIGS. 40A and 40B are GUIs showing record details of a feature requestmessage.

FIGS. 41A and 41B are GUIs showing record details of a registrationnotification message.

FIGS. 42A to 42D are GUIs showing preferences that may be set by a user.

In the flowcharts in this document, neither the particular breakdown ofthe logic into steps, nor the specific ordering of the steps, isrequired for implementation of the invention. Rather, the flowchartsprovide one illustration of the operational logic of the invention;other implementations consistent with that logic could also be reliedupon to practice the present invention. That the logic is illustrated incertain of the Figures according to a serial processing model, asopposed to, say, an object-oriented approach, is intended only forclarity of discussion, and does not limit the invention to a particularimplementation approach.

DETAILED DESCRIPTION OF THE DRAWINGS System Level Overview

FIG. 1 presents a high-level overview of the architecture of a systemincluding apparatus and methods for capturing fraud and customer-relateddata from a wireless system according to one aspect of the presentinvention. The system and the methods carried out by the system includetwo main components: (1) data monitoring and capture; and (2) generationof visibility and fraud data from captured messages.

Representative switch 10 of a wireless telecommunications system may bea mobile telephone switching office (MTSO), MSC or other known mechanismfor switching wireless telecommunications traffic from or to one or morewireless devices, an example of which is represented by antenna 5.Switch 10 couples by one or more links to corresponding elements of apublic or proprietary network operating under a signaling standard, suchas the SS7 standard. The switch 10 may be used by a cellular or PCScompany to transport wireless validation transactions (using, e.g., aprotocol like IS-41) on a switch-to-switch basis, rather than byresorting to a clearinghouse to perform validations. For purposes ofthis description, but without limitation, reference will be made to theSS7 signaling standard and to the IS-41 interim standard. (TheElectronic Industries Association/Telecommunications IndustryAssociation (“EIA/TIA”) has published Interim Standard 41, Revisions A,B and C. Copies of these are available from the Electronic IndustriesAssociation, 2001 Pennsylvania Ave., N.W., Washington, D.C. 2006. TheIS-41 standards, including all revisions, are hereby incorporated intheir entirety by this reference.) Nevertheless, the system is in no waylimited to functioning in the context of these standards, which includeall future revisions, but could just as easily be adapted to work withnetworks operating under other signaling or interim messaging standards.

Various embodiments of data capture devices 30 are shown in FIGS. 1 and2. Thus, link capture device 32, STP capture device 34 and switchcapture device 36 each comprise a data capture device 30. Each canidentify messages of interest out of a number of signals indicative ofwireless traffic over a wireless telecommunications system. Output froma particular data capture device 30 is forwarded to a central messageprocessor 50 by any suitable means for transporting digital data. Forexample, but without limitation, data retrieved and processed by linkcapture device 32 may be made available on a local area network (LAN),such as an Ethernet LAN, or over a corporate wide-area-network (WAN) 40,as illustrated in FIG. 1, to the central message processor 50.

Data capture devices 30 may monitor the wireless systems for anywireless traffic, including IS-41 messages, SS7 messages or TCAPmessages. Wireless traffic is buffered, individual messages identifiedand messages of a particular type of interest are selected. For example,assuming the network transports messages in an IS-41 standard format,any embodiment of data capture device 30 can at least identify andcapture the following set of IS-41 messages:

1. Registration Notification (“REG_NOT”)

2. Qualification Request (“QUAL_REQ”)

3. Qualification Directive (“QUAL_DIR”)

4. Service Profile Request (“SRV_PRF_DIR”)

5. Service Profile Directive (“SRV_PRF_REQ”)

6. Return Result

IS-41 return result messages do not indicate the invoke message type towhich they correlate. Accordingly, monitoring and capturing of allreturn results messages may be necessary to ensure that later messagecollating produces complete message sets that identify a wireless systemtransaction.

Alternative embodiments allow other or additional sets of message to becaptured. Alternative message types (and their functions) are describedin the IS-41 standards previously incorporated by reference as well asin future revisions and standards. Message sets may be selected forgathering not only data for customer support and fraud management, butalso for network engineering. For example, message sets dealing withcall setup or call feature activation may be chosen. Appropriate IS-41messages, like Route Request that gives the dialed digits anddestination, would be chosen to fill in this set, in which networkengineering might be interested.

Generally, changing to a different message set is done simply byidentifying which set of messages is to be captured and informing datacapture device 30 of that set by software exchange (e.g., by providing asystem disk or modem upload of the new message set of interest.) Also,if the invention is implemented with other than an IS-41 standard inplace, messages analogous to those listed above could be gathered bydata capture device 30. In any event, a set of captured and identifiedmessages may be formatted into TCP/IP packets, as seen in FIGS. 7A-7C,and forwarded to central message processor 50 for further processing.

The central message processor 50 is preferably a facility for receivingdata handled at a plurality of switches (not shown) and captured bycorresponding data capture devices 30 similar or identical in functionto link capture device 32, STP capture device 34 or switch capturedevice 36. IS-41 (or other) messages captured from SS7 links at switches10 by these data capture devices 30 may be provided to the centralmessage processor 50 via any suitable means, but in the preferredembodiment are sent in packets over a WAN 40 running the TCP/IPprotocol. Central message processor 50 aggregates, stores, and processesthe received IS-41 messages in order to provide coordinatedcustomer-related visibility and fraud data, as will be described indetail below.

Messages captured by data capture device 30, and processed by centralmessage processor 50 to yield useful data for visibility and fraudanalysis, can be made available for query by one or more client customeron-line stations (several of which are indicated by reference numerals60, 62 and 64) via WAN 40. These customer on-line stations are therebyprovided with visibility data for roaming wireless service subscribers,enabling on-line customer service representatives (operating on-linestations 60, 62, 64, etc.) to provide quick, high quality and responsiveservice to subscribers of (or roamers using) the wireless system.Furthermore, fraud data in the form of a roamer registration feed culledfrom each switch, of which switch 10 is a single example, may beprocessed by captured data processing device 50 and provided to a frauddetection system 80 via an appropriate link 68.

FIG. 2 illustrates representative data flows between components of theembodiment shown in FIG. 1. Link capture device 32 monitors each link towhich it is coupled for any message that belongs to a set of IS-41message types useful for customer on-line support and fraud data feedpurposes. In FIG. 2, N link capture devices 32 ₁, 32 ₂, 32 ₃, through 32_(N), each receive a corresponding feed from an SS7 link for aparticular switch. Also, STP capture device 34 receives a captured datafeed from a pair of STPs 24 and 26 and switch capture device 36 receivesa captured data feed from AT&T switch 11 that operates via theproprietary EFTN protocol. As described in connection with FIGS. 3-6,the link capture devices 32 _(1-N), STP capture device 34 and switchcapture device 36 each retrieve IS-41 messages and format the messagesinto packets (one format for which is described in connection with FIGS.7A-7C, below.) The resulting packets are transmitted to the centralmessage processor 50 via an appropriate transmission means, such as acorporate WAN 40 supporting the TCP/IP protocol, or other suitable path.

For example, but without limitation, the central message processor 50may be implemented by a Hewlett Packard HP 9000 K400. The centralmessage processor 50 preferably includes a subprocessor corresponding toeach link capture device 32 _(1-N), STP capture device 34 and switchcapture device 36 for receiving and processing received IS-41 messagepackets. Each of the subprocessors of central message processor 50preferably runs in parallel a set of message pairing and processingprocedures 120 _(1-N), each corresponding to the message feed receivedfrom a particular data capture device 30 over WAN 40. The operations ofthese procedures are discussed below in connection with FIGS. 8-10.

Each message processing and pairing operation 120 _(1-N) writes itsresults to an associated daily file 130 _(1-N) that contains pairedIS-41 invoke and return-result messages for a particular day. The sameprocess also detects registration notification messages (Reg_Not) andwrites them to Reg_Not file 160.

Records in the daily files 130 _(1-N) containing paired message data areparsed by associated record parsing and database insertion processes 140_(1-N). These processes 140 _(1-N) each insert their results into adatabase 150 of normalized IS-41 messages. Database 150 may beimplemented by a suitable, commercially available database, such as(without limitation) an Informix Software, Inc. relational database.Other suitable databases, such as those marketed by Sybase and Oraclemight also be used. Results inserted into database 150 preferably arealso organized by day, so that previous days' results are available:paired messages for the day prior to the current day may be stored in adatabase table 150 ₁; for the day two days prior to the current day maybe stored in database table 150 ₂; through a period N days prior to thecurrent day may be stored in a file 150 _(N).

IS-41 messages typically contain information regarding the originationand timing of message generation. Thereby, the central message processor50 can process paired message (and expired invoked messages) to sortthem by day and occurrence of call. Sorted message are then indexed,segmented by date and stored in the database 150. Database 150 thusprovides comprehensive visibility data available for query according toknown techniques by customer on-line workstations, e.g., workstations60, 62, and 64.

The registration notification (Reg_Not) messages stored in Reg_Not file160 are processed and filtered according to a procedure 170 described indetail in connection with FIG. 11. The resulting filtered data may beprovided via link 68 as a fraud feed comprising roamer registrations.This fraud feed can be used by existing fraud detection systems, such asfraud system 70, to detect various instances of fraudulent system use.

Data Capture Devices

FIGS. 3-5 illustrate the components and functionality of variousembodiments of data capture devices 30.

FIG. 3 shows the data links and functionality of an embodiment of a linkcapture device 32 and one method for capturing fraud and customer datafrom a wireless system according to the system as illustrated in FIGS. 1and 2. Generally, each SS7 link may be passively monitored, and desiredportions of the monitored traffic, like particular IS-41 messages, maybe captured without disrupting the functioning of the switch 10. Inparticular, a suitable link capture device 32, implementations for whichare described below, is coupled to the switch 10 via a bridging isolator20. Bridging isolator 20 is coupled to one or more links of the SS7network of which the switch 10 forms a part. Bridging isolator 20 may be(without limitation) a HP15821A Multiple Balanced Bridging Isolatormanufactured by Hewlett Packard, or any suitable device capable ofproviding passive balanced resistive and transformer isolation betweenthe link capture device 32 and the SS7 network. Link capture device 32can be implemented, for example (but without limitation), by a HP 37900DSignaling Test Set, a protocol analyzer manufactured by Hewlett PackardCompany. Other devices that may be suitable for performing the describedlink data capture function, if properly programmed to perform functionsdescribed below, are marketed by other vendors, including TecElec, Inet,Techno or Seimens.

Link capture device 32 passively monitors signals on the links accessedvia bridging isolator 20, and extracts desired fraud andcustomer-related information, discussed below. To maximize itsprocessing efficiency, the link capture device 32 preferably can monitora plurality of signal links and can be programmed to perform specifictasks. For example, the HP 37900D may monitor up to four SS7 links andmay be customized to conduct desired measurements and to process thegathered data, as will be further described below. If the switch 10 hasa greater number of links than can be monitored by a single link capturedevice 32, more link capture device 32 can be used and incorporated intothe system architecture. For example, if a link capture device 32 isimplemented by a HP 37900D and the switch 10 handles nine SS7 networklinks, three data capture devices 30 would be required. But the numberof input ports could just as easily be raised (or lowered) dependingupon the specifications of the equipment implementing the link capturedevice 32. Thus, a link capture device 32 with additional link interfacecards inserted in its chassis and additional processing power could bedeployed.

FIG. 3 shows an SS7 switch data link 12 that includes four SS7 linkscoupled to bridging isolator 20. Each of four data lines 14-17 frombridging isolator 20 couples to an input port of link capture device 32.A telecommunications link interface 102, 104, 106 and 108 corresponds toeach input 14-17. Each link interface 102-108 may be implemented by, forexample, a signaling interface card, a T1 or V.35 interface card or anyother suitable interface. In FIG. 3, link interface 102 couples to dataline 14; link interface 104 couples to data line 15; link interface 106couples to data line 16; and link interface 108 couples to data line 17.Each link interface 102-108 transduces the signal on the correspondingdata line 14-17, making it available to be read, stored or otherwisemanipulated by link capture device 32.

An operating system 112, running on an internal processor of the datacapture device 30, monitors all active link interfaces 102-108. In oneembodiment, but without limitation, the operating system functionalitymay be implemented by a Pascal 3.2 workstation system on, e.g., the HP37900D. A daemon subprocessor of the operating system 112 listens forIS-41 messages on the link interfaces 102-108 and, when one is received,writes it temporarily to a link message buffer 110, where it may bestored (along with other such messages) according to afirst-in-first-out (FIFO) discipline.

Upon the occurrence of a periodic interrupt, operating system 112initiates a real time decoder process 114, the logic for an embodimentof which is provided in FIGS. 6A and 6B. In the period betweeninterrupts, many IS-41 messages may have been received by the linkinterfaces 102-108 and temporarily stored in the link message buffer110. The periodic interrupt permits the real-time decoder process 114 toretrieve captured IS-41 messages from the link message buffer 110 forprocessing and transmission to central message processor 50, asdescribed in connection with FIGS. 6A and 6B.

FIG. 4 illustrates an STP capture device 34 that obtains messages ofinterest from STP pair 24, 26. Generally, a Signal Transfer Point(“STP”) is a high-capacity packet switch that routes messages betweennetwork access nodes such as switches (MSCs) and databases (like SCPs).An STP typically comprises geographically separated pairs so that if oneSTP fails the other can handle total traffic volume (thus, the volume ofmessage traffic for a single STP should never exceed fifty percent ofits capacity.) Each STP 24, 26 in a pair has a preprocessor 25, 27.Preprocessors 25, 27 can be implemented on an HP 725/50 UNIXworkstation. (Depending on the features the preprocessors 25, 27implement, other properly programmed computers with less or even moreprocessing power could be used to implement the preprocessor. Forexample, preprocessors with greater processing power could provideroaming or engineering reports as well as captured data.) Eachpreprocessor 25, 27 implements a daemon subprocessor called STP catcher42 that reads messages from one or multiple LAN card(s) located at thecorresponding STP 24, 26. STP catcher 42 filters the messages comingacross the LAN card(s) and selects only those messages belonging to adesired type. Selected messages may be formatted (one format may be thatshown in FIG. 7) and provided to log buffer 43. Daemon subprocessor STPpitcher 44 reads the buffer and transfers messages via a LAN or othercommunication medium to STP merge processor 35. Control messagesexchanged between preprocessors 25, 27 and STP pair 24, 26 assuresynchronization. (Control messages can comprise time exchangeinformation in the RFD 868 standard protocol.)

Because STPs are paired, related messages could come across differentSTPs. Thus, for example, an IS-41 invoke message could come across STP24 and its corresponding IS-41 return result message could come acrossSTP 26. Message traffic captured from each STP 24, 26 is merged via amerge catcher process 46 that may reside on STP merge processor 34,which may be implemented with an HP K 400. This ensures that allmessages of interest are combined for forwarding by message datacommunication process 48 to the central message processor 50. Themessage communication process 48 implements the real-time messagedecoder 114 process shown in FIGS. 6A and 6B and described below.Generally, this process formats and sends received messages to thecentral message processor 50.

To central message processor 50, the data feed flowing from STP capturedevice 34 is just like any other data feed from any other data capturedevice 30. Thus, processing of data captured from STP pair 24, 26proceeds as described generally above and in more detail in textassociated with FIGS. 8-11.

FIG. 5 shows switch capture device 36. Switch 11 is an AT&T switch thatoperates via a proprietary format, EFTN, often favored by wirelessservice providers because of advanced features it provides thatotherwise would not be available. Switch 11 comprises various componentsincluding at least one Executive Control Process (“ECP”) and connects toan Operations and Management Platform (“OMP”) 53 provided by AT&T. OMP53 may be provided with a package (purchased from AT&T) capable oftranslating any EFTN message that has an equivalent IS-41 message intothat equivalent. The equivalent is then stored in a buffer located atOMP 53. The buffer may be polled for messages of interest.

Thus, Message Visibility (“MV”) client process 54 may periodicallyrequest from the OMP 53 IS-41 messages of a particular class or classes.Requests from the “client” switch capture device 36 to the “server” OMP53 initiate a Remote Procedure Call (“RPC”) protocol that executes aserver function running on the OMP 53 to send requested data. MV clientprocess 54 filters received messages, transmitted in TCP/IP format, tochoose only message types of interest, as defined by the preselectedset. For instance, the set of six messages identified above could beselected. Selected messages are written to a daily file, like directaccess storage 55. A message data communication process 56 formats thestored messages into an appropriate format (such as that shown in FIGS.7A-7C).

Components of switch capture device 36, (e.g., MV client process 54,storage 55 or message communication process 56) may reside on centralmessage processor 50 to maintain transparency across the system.Formatted messages are stored in a file within central message processor50 so that the processing portions can parse the file and obtain thestored messages. (Message communication process 56 has the samefunctionality as message communication process 48 described in FIG. 4.)To the message processing portions of the central message processor 50,messages received from switch capture device 36 are the same as messagesreceived from other data capture devices 30 and processed in the samefashion.

Industry trends are away from proprietary protocols and towardstandardization. Nevertheless, even though switch capture device 36 isdescribed as for use with the AT&T switch 11, it could easily bemodified to work with other manufacturers' switches should trendsreverse and proprietary protocols be deployed (and assumingmanufacturers offer translation packages).

Each embodiment of data capture device 30 could be monitored for failurein its data feed. For example, a daemon subprocess may be provided onthe link capture device 32, the STP capture device 34, or the switchcapture device 36 that periodically checks to ensure that the captureddata has been transmitted. If a selected interval passes without datatransmission, the daemon subprocess could activate an automatic dialingdevice that causes a preselected paging number (or several) to be dialedand a stored message to be sent. Thus, one or several designated networkservice personnel could receive a message that identifies the particulardata capture device 30 and indicates that its data feed was down.Network service personnel could then promptly proceed to place the datacapture device 30 back on line.

Selection and Packaging of Captured Data for Transmission

Returning to a more detailed description of link capture device 32, FIG.3 shows various processes implemented by it and FIGS. 6 and 7 describethose processes in detail. Processing and formatting associated withFIGS. 6 and 7 also may be implemented by the STP capture device 34 orswitch capture device 36. (Although TCP/IP connection requests do nothave to be made for the switch capture device 36, implementing the samefunctionality of other data capture devices 30 enhances systemstandardization and transparency.)

A real time decoder (“RTD”) process 114 is entered at 120 by a functioncall. Each function call processes a single IS-41 message stored in thelink message buffer 110, preferably the earliest received messageconsistent with FIFO principles. Processed messages are transmitted overWAN 40 from data capture device 30 to central message processor 50. Asshown in FIG. 6A, following entry into RTD process 114 at step 120,condition check 122 determines whether a delay timer has expired.

The delay timer forces a wait time between reconnection attemptsfollowing either a shut down request or some other connectioninterruption. The delay timer therefore prevents expending too muchprocessor time in fruitless checking of the connection. For example, thedelay timer can be set for a first delay of thirty seconds. Afterexpiration, connection check 124 determines whether a connection is up.If not, initialization step 126 attempts a connection. When noconnection can be made, the delay timer is set and begins running again.(A longer delay (e.g., five minutes) might be chosen for this seconddelay period so that the connection problem can be resolved beforeinitiation of another connection check.)

Generally, the RTD process 114 logs the incoming IS-41 message at step150 (FIG. 6B) in a buffer, such as a circular buffer (not shown). TheRTD process 114 then returns to the instruction of the operating system112 (in FIG. 3) which had been the next step prior to the RTD process114 having been called.

If condition check 122 instead reveals that the delay timer has expired,RTD process 114 determines (according to known methods) at step 124whether the data capture device 30 had an established TCP/IP connectionwith central message processor 50 across WAN 40. If no such connectionestablished, RTD processor 114 at step 126 initializes a socket openprocess and attempts to set up a TCP/IP connection with the centralmessage processor 50 over the WAN 40. The RTD process 114 at step 128checks for a successful attempt to set up a TCP/IP connection. If not,the delay timer is set at step 129, the current message is logged atstep 150 (FIG. 6B) in the circular buffer, and control is restored tooperating system 112.

On the other hand, when condition check 124 shows a TCP/IP connection,the current message from link message buffer 110 is decoded according toknown methods. Specifically, the message is examined to determinewhether it is one of a set of messages of interest. In one illustratedembodiment, the decode message and IS-41 process 130 determines whetherthe message is one of six IS-41 messages of interest. Messages not ofinterest are discarded. (In STP capture device 34, STP catcher 42 mayimplement decode message process 130; in switch capture device 36, MVclient process 54 may implement decode message process 130.)

Messages of interest are formatted (as shown at step 154 in FIGS. 7A-7Cand described below) and held for transmission. Then, or if conditioncheck 128 confirms an established TCP/IP connection, the RTD process 114checks at step 132 whether any messages are in the circular buffer,which holds messages unsent due to lack of a network connection withcentral message processor 50. RTD process 114 at step 134 attempts tosend the next message available in the circular buffer over the WAN 40to the central message processor 50. Send check 136 determines if thetransmission attempt of step 134 was not satisfactory; if not, then themessage is left in its location in the circular buffer and retrieved forsending at a later time. On the other hand, after a successfultransmission at step 134, RTD process 114 checks whether either allmessages in the circular buffer have been sent (i.e., the buffer hasbeen flushed) or a pre-set maximum number of messages from the circularbuffer have been sent. Transmission continues until either condition ismet.

After step 138 determines all or a pre-set number of messages were sent,then (referring to FIG. 6B) RTD process 114 checks at step 140 for anincoming message, like one from an operator or from central messageprocessor 50. If a message has been received (e.g., at a TCP/IP socketover WAN 40), host process step 142 processes it. For example, the hostcould send any of multiple messages including: (i) a shutdown message;(ii) a shutdown response or (iii) an error message. Shutdown messagesrequest the link capture device 32 to close connections and properlystore all data received but not yet transmitted upon receipt of ashutdown request. Link capture device 32 also can request shutdown. Inthat case, the shutdown response from central message processor 50acknowledges and authorizes shutdown. Error messages simply indicate asystem error. They are logged so that the time and date of the error istracked for later analysis.

Shutdown check step 144 determines if the processed message indicatesthat a shutdown of a data capture device 30 has been ordered. (Ashutdown message may be sent, for example, if a link capture device 32is to be removed from service for maintenance or other reasons.)Shutdown results in closing the TCP/IP connection at step 146 andsetting the delay timer at step 148. The message is logged in a file,and control returns to the operating system 112. According to thedescribed logic, graceful shutdown can thereby be achieved, since anydata currently being handled is retrievably stored, avoiding its loss.To facilitate an operator (of the data capture device 30 or centralmessage processor 50) in removing the device from service without thecentral message processor 50 failing to be notified, data capture device20 may optionally include a “hotkey.” The “hotkey” prompts an operatorof the data capture device 20 for confirmation of a command to shutdowncommunication and would forward a message to central message processor50 if confirmation were received.

If step 140 had detected no incoming message from the socket, RTDprocess 114 determines whether the circular file is empty at step 152.This condition might occur if, for example, a pre-set maximum number ofmessages can be sent, and have been (as determined at step 138), but thecircular buffer still contains messages. Transmission of the currentmessage from link message buffer 110 would occur prior to sendingearlier-received messages. Therefore, if the circular buffer is notempty, the current message is stored there in order to maintain FIFOdiscipline.

In the absence of a shutdown message, then at step 154 RTD process 114attempts to send the current message over the WAN 40 to the centralmessage processor 50. Control returns to the operating system 112whether the message was successfully sent or not successfully sent (inwhich case it is subsequently logged in the circular file at step 150).

Each captured IS-41 message sent at step 154 (FIG. 6B) is preferablysent in a separate packet or other discrete block of data. Numerousformats providing suitable functionality could also be used. Generally,the format selected is such that the system is provided sufficientinformation regarding the origination (source, timing, etc.) of packageddata that error tracking and debugging is easier. If the TCP/IP protocolis used, however, FIGS. 7A-7C show one manner of formatting a datapacket. The format shown is an application level format that can workwith any other protocol, for example, X.25.

Thus, a data packet containing a captured IS-41 message is organizedinto a TCP/IP packet containing a header of nineteen bytes and avariable length data block, as shown in FIG. 7A. The header, shown ingreater detail in FIG. 7B, includes: (1) an STS ID that may be a threebyte ASCII identifier (which may be stored at and retrieved from astorage medium such as a disk drive) for uniquely identifying theparticular data capture device 30 from which the data is sent; (2) alink number identifier of three bytes for specifying from which of themonitored SS7 links the captured message was derived if a link capturedevice 32 obtained the message; (3) a one-byte opcode for indicatingwhether the packet is carrying data or whether the data capture device30 is shutdown (an ASCII D indicating data and an ASCII S indicatingshutdown); (4) a message type code of one byte and containing ASCII forone of the integers in the set {1, . . . , N} of messages of interest toidentify which type of IS-41 (or other standard) message was captured;(5) a TCAP (transaction capabilities application part, a component ofthe SS7 architecture) transaction ID of six bytes and (6) an indicationof the total message length, allocated five bytes. The data portion ofthe message packet, shown in FIG. 7C, includes a time stamp of fourbytes for containing an integer indicating the time at which the messagewas captured. A TCAP transaction ID field and DPC/OPC (Destination orOrigination Point Codes) field also are included in the data portion.Finally, the unaltered IS-41 message payload, which can be of variablelength, completes the data. Preferably, one captured message isallocated to a particular packet.

Generally, the same packet format can be used for message originatingfrom a STP capture devices 34 or a switch capture devices 36. For STPcapture devices 34, the STS ID may be its particular assignedidentification number and the link number may be the individual ECU fromwhich the packet originated. (MSCs may have multiple ECPs that areusually included in IS-41 message headers.) The header for the switchcapture device 36 will include the same information (i.e., switchcapture device 36 identification and ECU identification). While theinformation in the packet shown in FIGS. 7A through 7C is generally usedfor system maintenance and debugging, it also has some use to customersupport personal at customer on-line work stations 60, 62 and 64. Forinstance, the DPC/OPC point codes may be displayed on the work stations60, 62 or 64 to indicate generally the origination and designation ofparticular message. (Even though a number of SIDs may be associated witha particular point code, there is some correlation between the pointcode and location of a subscriber; experienced customer servicesrepresentatives will recognize and be assisted by this correlation.)

Processing of Captured Data

Referring again to FIG. 1, data capture devices 30 are coupled to thecentral message processor 50 by a suitable data transmission mediumlike, for example, the WAN 40. Central message processor 50 cancommunicate by way of the WAN 40 to one or more customer on-linestations 60, 62, and 64 or to the fraud detection system 70.

Central message processor 50 preferably may receive, aggregate and routeinput from a number of data capture devices 30 or analogous devices.Central message processor 50 may be implemented by any processing devicehaving sufficient input/output channels and processing capacity forperforming the operations described below, and running any suitableoperating system. For example, central message processor 50 may be anHP-840, manufactured by Hewlett-Packard Co. and running the UNIXoperating system, HP-UX 10.0. Alternatively, the central messageprocessor 50 may be an HP 9000 H40, also manufactured by Hewlett PackardCo. (Any workstation programmed configured according to the presentinvention could conceivably perform as the central message processor 50depending on the volume of records and number of users.)

FIG. 2 describes the functionality and data flows associated withcentral message processor 50 regardless of the platform used toimplement it. FIGS. 8-11 illustrate the logic flows associated withprocesses implemented by central message processor 50 for carrying outits functions.

FIG. 8 illustrates the logic flow for a high level loop 200 implementedby central message processor 50. Since the primary function of thecentral message processor 50 is to collect data sent to it by aplurality of data capture devices 30, the central message processor 50devotes a portion of its attention to monitoring input received at itsports. To this end, it implements server functionality for interfacingwith an application program running on a remote client system. Theinterfacing functionality may be implemented, for example and withoutlimitation, by the TCP/IP Sockets API (application programminginterface). The Sockets API may be used to implement a client-serverrelationship between two application programs running in differentcomputing environments, such as between data capture devices 30 andcentral message processor 50. The Sockets API can permit access toprotocols other than TCP/IP.

After initializing at step 202, the high level loop 200 processes thesockets, via which the results from data capture devices 30 arereceived. As long as the loop has not been terminated, as checked atstep 204 (While NoKill), a process sockets routine 300, illustrated inFIG. 9, is called. When (i) the high-level loop 200 returns from theprocess sockets routine 300, (ii) the end of the loop 200 is reached at208, and (iii) if shutdown has been requested by the operator, then theprocess implements a shutdown routine 210 that stores any unprocesseddata to prevents its being lost. The high level loop 200 then exits at212. As long as no shutdown request has been received, however, the highlevel loop 200 cycles between steps 204 and 208, continually processingTCP/IP packets received at the sockets from the data capture devices 30.

Logic flow associated with the process sockets routine 300 is shown inFIG. 9. Generally, there are many socket child processes, whichinitialize in order to handle each connection request from particulardata capture devices 30. Initially, an event log file is opened at 302and an error log file is opened at 304. These files are used for generaldebugging and maintenance activities. For example, the event log filemay be used for informational messages like open, close, shutdown, etc.The error log records warnings and system errors. At 306 the processwaits for connection requests from a number (1, . . . , N) of datacapture devices 30 that are essentially clients served by the centralmessage processor 50. When a TCP/IP connection request has beenreceived, routine 300 at step 308 forks a new child process 312 tohandle it. The routine 300 binds the newly forked child process 312 to asocket at 310, creating as many child processes 312 _(1-N) bound to eachsocket as there are data capture devices 30 that have requestedconnections to central message processor 50.

Of course, switch capture devices 36 that reside on the central messageprocessor 50 can store their captured data in a file on the centralmessage processor 50. No process sockets routine need be initiated forthese switch capture devices. Instead, the collation processing shown inFIG. 10 is done by accessing the resident file holding the captureddata.

Logic flow associated with a collation process 400 of each forked childprocess 312 _(1-N) is illustrated in FIGS. 10A-B. The collation process400 collates received messages to yield more useful visibility and frauddata. At step 402 the message contained in the packet received from thedata capture device 30 corresponding to the current socket is retrieved.Type check step 404 checks to determine whether it is an invoke message.Invoke messages are processed via searching step 408 that searches thepairing buffer for its matching return result message. Matches may befound by comparing the transaction IDs and DPC/OPC of the message.(IS-41 messages each carry a transaction ID; return result messages havean ID that matches the ID of the invoke message leading to generation ofthe return result message.)

No match as determined by check step 412 results in the invoke messagebeing written by step 416 to the pairing buffer 410 and Reg_Not messagefile 160. On the other hand, when matches are found at step 412 they arewritten to the daily files paired messages database 130 and the Reg_Notfile 160 at record step 414. (Reg_Not messages written to Reg_Not file160 will later be retrieved and processed according to logic describedin connection with FIG. 11.) The collation process 400 then begins againat step 402, which retrieves the next message.

Assuming the next message is not an invoke message, it will pass throughtype check step 404. Step 406 checks the passed message, which either isan error or return result message. Error messages are logged at step418. Return result messages are processed by the logic of FIG. 10B. Step420 searches the pairing buffer 410 for the invoke message that matchesthe return result message being processed. If no match is found at checkstep 422, the return result message is added to the pairing buffer 410.Matches, however, found at check step 422 are written at record step 426to the daily file database 130. After either adding the return resultmessage to the pairing buffer 410 or, if paired, to daily file database130, the loop restarts at step 402.

Note that the processing associated with FIGS. 10A and 10B is directedto finding mates of invoke and return result messages and saving unmatedmessages until missing mates are captured and matched. This processingis necessary since the invoke and return result messages may notnecessarily be captured and transmitted to the central message processor50 immediately in the order in which they were generated. Thus, it ispossible that a particular return result message is received well beforeits mating invoke message. Absent proper processing the return resultmessage may be lost, eliminating valuable visibility or fraud data. Forreturn result messages resident in the pairing buffer 410 for longerthan a predetermined period, those “expired message,” are identified bystep 420 and then discarded. This is because the central messageprocessor 50 generally receives return result message that may relate toinvoke message that are not of a desired IS-41 message type. On theother hand, expired invoke messages identified at step 408 are flaggedas unpaired and sent to the daily file database 160 for ultimateforwarding to a customer support station 60, 62 or 64 or fraud detectionsystem 70. Expired invoke messages are saved because they may stillprovide the system information such as why the customer had a problem.

Elimination of Redundant Data

Logic flow for the registration message processing and filtering 170 isillustrated in FIG. 11. As described in the Background section, frauddata comprising roamer registrations may already be available (e.g.,from GTE Nationwide Roamer Data Delivery Services, GTE-TSI's “IREC”service or the Roamex service provided by Systems Link). A serviceprovider employing systems and methods described in this document mayalready be using these or similar existing fraud data services,particularly if deploying the systems and methods described still wouldnot provide total coverage for a market of interest. Also, such thirdparty systems may provide services other than just fraud data. Forexample, billing applications could be supported by other data providedby third party systems.

Multiple sources of fraud data (i.e., data captured by the presentinvention and data provided from third party systems) may generateredundant data incoming into fraud detection system 70. This isobjectionable for several reasons. First, the service provider is payingper transaction fees (which translates into a lot of money) for datathat a system such as the present invention is already providing.Obviously, purchase of the redundant data from the third party systemcould be discontinued. But other data or services provided by the thirdparty system may render that course impractical. Second, the frauddetection system 70 may generate erroneous results in the form of falsepositive fraud detections. With multiple data sources, two or morerecords of the same event could be generated, which may trigger a frauddetection system since it may analyze the data and conclude thatmultiple phones with the same MIN/ESNs were operative at the same time.Further, sending and processing redundant data ties up network bandwidthand valuable processing power.

To eliminate redundant data, the present invention provides aregistration message processing and filter process 170 (implemented bycentral message processor 50) as described by the filtration process 500shown by FIG. 11. A filters table 502 includes the identification ofevery MSC for which data is commercially received. Typically theidentification is a System Identification Number or “SID” and, forsmaller providers that simply contract another provider's network andprovide billing services, a Billing Identification Number or “BID.”Thus, for example, if data were already being sent to fraud detectionsystem 70 for a switch in Nashville, Tenn., the filters table 502 wouldinclude that system's SID (or BID).

Once the filters table 502 has been loaded into memory at load step 504,creating a list of SIDs (and BIDs) whose data should be filtered out,the next Reg_Not messages are read from a daily Reg_Not file 160 at readrecord step 506. As noted, IS-41 messages carry various originationdata, including the SID (or BID) for the MSC servicing the customer whogenerated the particular Reg_Not message (“Serving_MSC”). At comparisonstep 508, a check is made as to whether the SID for the Serving_MSC fromwhich the Reg_Not message came matches any SID in the filters table 502loaded in memory. If a match is detected, the present Reg_Not messageread at step 506 is ignored, and the process loops to select at step 506the next record from Reg_Not file 160 and compare the SID associatedwith that record against the SID values in the filters table 502. Againany Reg_Not message with a Serving_MSC listed on the filters table 502is ignored. But if the Serving_MSC is not on the filters table 502, thenthe current message is transmitted by a transmission process 510 to afraud detection system 70. Transmission process 510 may also implement aprocess for appropriately packaging the data to match the format of aparticular fraud detection system 70. Thus, by way of example, if usedwith the CloneDetector system, the message is parsed for its SID and aheader necessary to implementing the CloneDetector functionality isadded. (Customized packaging of the filtered data to match formatsrequired by other fraud analysis systems is well within the ability ofone skilled in the art.)

In this way, a fraud data feed in the form of non-redundant roamerregistrations is sent to a fraud detection system 70. The frauddetection system 70, using data from this feed and perhaps other feedslike those from third party systems described above, analyzes this datato help detect fraud.

Customer On-Line Support Applications

Customer on-line support requires a user friendly system, typically runin a WINDOWS environment, for viewing in real time current roamingtraffic in and away from home markets and allowing inquiries on roamerstatus anywhere within the digital SS7 network. A properly designedcustomer on-line support system provides an extremely efficient methodfor obtaining and displaying large volumes of data in real time. Thedata must be properly organized and displayed in order to give thecustomer service representatives a better picture of the wirelessservice provider's home market and the provider's roaming customers. Onesuch on-line support system is shown deployed on support stations 60, 62and 64 in FIG. 1. FIG. 12 shows the functionality that may beimplemented by the support stations 60, 62 or 64.

A customer support operator accesses the support system at access step600 by invoking the graphical user interface (“GUI”) and inputting atreceive step 602 an ID and password. After the database is queried atstep 604, an ID and password check is performed at validity check step606. Invalid IDs or passwords generate an error message displayed atstep 608. Otherwise valid IDs or passwords generate a main option screenat step 610. A cellular user's MIN or ESN and search parameters areentered at step 612. For example, the number of days of call activitydata for the input MIN may be one search parameter. Search criteria foridentifying the user other than MIN or ESN may be used for other frauddetection systems. Alternatively, instead of manually entering searchparameters each time, the system can be set to a default search or theoperator can enter a “profile” sequence number associated with specificsearch parameters.

In any event, the database upon which all system fraud data resides isopened at step 614. The database is partitioned by day so thatinformation retrieval is more efficient. Step 614 opens and prepares thedatabase, while step 616 confirms that operation; if there is a failurean error message is displayed. Records are fetched from the database atstep 618 and added to the main screen list box at step 626. The mainscreen list box allows the customer support application to store in RAMthe results for the search parameters entered. This allows theparticular customer on-line support stations 60, 62 or 64 to obtain itssearch results and load them locally for further processing, therebyproviding distributed processing of search results to eliminate orminimize demands on the host database and its processor. If step 620determines that a record fetch was unsuccessful, it may mean that thesearch results all have been retrieved. But if step 622 also determinesthat more data rows should be displayed, an error has occurred that step624 displays. Otherwise, step 622 cycles back to the main screen displaystep 610 to await a new search by the operator.

A General Case

This document has focused on describing several possible embodiments ofthe present invention, describing in particular detail alternativeembodiments of data capture devices 30 coupled with a central messageprocessor 50. Those skilled in the art will understand that of thealternative data capture devices 30 disclosed, the link capture device32 is one of the most flexible because persons implementing the presentinvention need not rely on the assistance of third parties. For example,implementation of STP capture device 34 requires access to the telephonecompany's network; not all wireless providers will have such access,particularly where the network operator is a fierce competitor.Similarly, the switch capture device 36 requires obtaining expensivetranslation packages from switch manufacturers like AT&T and places theprovider implementing the switch capture device 36 at the mercy of theswitch manufacturer, who could always change protocols, overcharge foror eliminate altogether the translation packages.

Additionally, although the described embodiment discusses using a“central” message processor 50, the functionality of the central messageprocessor 50 may be implemented by the data capture devices 30 simply bychoosing platforms with sufficient processing power to perform thecollating and filtering tasks of the central message processor 50. Forexample, link capture device 32 or STP capture device 34 each could bedeployed on larger, more powerful workstations and couple via bus to aprocessor portion that processes selected message, pairing invoke andreturn result messages and saving unpaired invoke messages. Filterstables could even be downloaded to each data capture device 30 so thatthey can do necessary filtering of redundant fraud data.

Indeed, such a network design would decrease overall system bandwidthrequirements and take advantage of the flexibility of distributedprocessing. That is, by having a central message processor 50 performmessage collating and filtering, providers implementing the presentinvention must capture and send all return result messages as well asthe invoke messages of interest to the central message process 50. Thisobviously consumes significant system bandwidth. Of course, it may allowfor lower hardware costs since less powerful processing platforms needbe deployed as data capture devices 30. In any event, those skilled inthe art will recognize that the present invention contemplates variousembodiments of data capture devices 30 and either distributed or centralprocessing of captured messages so as to provide useful fraud, roamervisibility, customer support, network traffic management or other datauseful in administering a wireless telecommunications system.

The foregoing is provided for purposes of explanation and disclosure ofpreferred embodiments of the present invention. Modifications andadaptations to the described embodiments, particularly includingchanges, upgrades or revisions in response to new or revised signalingand transmission protocols or standards (including without limitation,X.25, IS-41, or SS7 standards), or changes in system architecture, willbe apparent to those skilled in the art and may be made withoutdeparting from the scope or spirit of the invention and the followingclaims. By way of example, the “IS” in IS-41 stands for “InterimStandard.” IS-41 Rev. C has now been accepted by American NationalStandards Institute and is referred as ANSI-41. It is fully expectedthat the standard will be revised and message types of interest to usersof the present invention will be added, particularly as new servicefeatures are deployed over networks. The present invention contemplatesmonitoring and capturing of such future message types.

System Level Overview of Alternate Embodiment

A second embodiment of a system 700 is shown in FIG. 13. As with theembodiment shown in FIG. 1, the system 700 monitors and capturesmessages traveling over an SS7 network, such as SS7 network 701. Thesemessages may be captured in any suitable manner, such as with datacapture devices 30 described above with reference to FIG. 1. These datacapture devices 30 are not limited to any specific type of equipment butinstead may comprise, for instance, the link capture device 32, STPcapture device 34, and switch capture device 36. The data capturedevices 30 preferably includes the STP data capture device 34.

The data captured by data capture devices 30 are forwarded over anetwork 704 to a system 710. The network 704 may comprise any suitablenetwork, such as an Ethernet Local Area Network (LAN) or other type ofLAN or Wide Area Network, such as WAN 40.

The system 710 performs many of the functions of the central messageprocessor 50 and fraud detection system 70. Consequently, in order toavoid introducing redundant material, reference may be had to thedescriptions above for an explanation of these functions andimplementation of the functions.

In summary, the system 710 includes a catcher 712 that operates 24/7 andreceives the data that is captured and sent over the network 704. Thecatcher 712 stores records in a daily file 718 and also a RegistrationNotification (RegNot) file 714 or Reject file 716. A RegNot pitcher 720transfers data from the RegNot file 714 to a clone detector system 732over a network 730. The clone detector system 732 may comprise the frauddetection system 70 or any other suitable system for detecting clones.

A Reject parser 724, an ANSI-41 parser 726, an update stats unit 742,and a distinct MIN unit 748 have access to a database 740. The database740 is comprised of separate tables, fields, and storage areas which aredescribed in more detail below. The Reject parser 724 reads data in theReject file 716 and inserts or updates data within a database 740. TheANSI-41 parser 726 reads the data in daily files 718 and parses the datainto separate tables and fields within the database 740. The updatestats unit 742 selects records from the database 740 and updatesstatistical information stored in the database 740 and also a distinctMIN file 746. This statistical information, as described in more detailbelow, can be relayed to users through one or more interfaces 760. Thedistinct MIN unit 748 access data from the distinct MIN file 746 anddatabase 740 and maintains a separate record for each MIN for each day.

The interface 760 may comprise stations, such as on-line stations 60,62, and 64, having access to the database 740 through a network 750. Aswith stations 60, 62, and 64, interface 760 support queries for use bycustomer support as well as by other personnel. The system 710 supportsthe same types of queries as the system in FIG. 1, namely queriesrelated to roamer visibility, fraud, network traffic, networkengineering, customer support, marketing, and other aspects ofadministrating a network. Specific examples of these queries will beprovided in the description below.

Although networks 704, 730, and 750 have been shown as TCP/IP networks,it should be understood that the invention may employ other types ofnetworks, such as frame relay or ATM networks. Furthermore, although thenetworks 704, 730, and 750 have been depicted as separate and distinctnetworks, these networks may instead form a single network.

A general description of the processing performed by the system 700 willbe provided with reference to FIG. 14 followed by more detaileddescriptions of the processing with reference to FIGS. 15 to 42. FIG. 14depicts a process-table relationship of the system shown in FIG. 13. TheANSI-41 parser 726 is depicted as a parse object 726, the update statsunit 742 as an upd_stats object 742, a distinct MIN unit 748 as distmin2object 748, and RegNot Pitcher 720 as RegNot/QualReq object 720.

In general, the parse object 726 inserts a record into a call_detail2table 804 with this record preferably being a pair of ANSI-41 messages.A child process is spawned after receiving the message and this childprocess inserts the message record into one of the message tables 806.If the message, however, is a RegNot, which is a RegistrationNotification sent to the HLR to indicate that a customer has been newlyregistered or re-registered, or a QualReq, which is a QualificationRequest used to request validation of a mobile or request validation andprofile of a mobile, then the message is stored in a RegNot/QualReqtable 720. In the preferred embodiment, each of the message tables 806and RegNot/QualReq table 720 stores a unique message type whereby themessages stored in message table 806, differs from the messages storedin message tables 806 ₂ . . . 806 _(N) and from the messages stored inRegNot/QualReq table 720. Thus, with 54 different ANSI-41 messagespresently available, the system 710 may have a RegNot/QualReq table 720and 52 different message tables 806 ₁ to 806 ₅₂. The invention, however,is not limited to the 54 presently available ANSI-41 messages but, aswill be more apparent from the description below, encompasses additionalmessages transmitted over the SS7 network 701.

The upd_stats object 742 selects records from the RegNot/QualReq table720, writes all valid records into a daily file dmfileMMDD.dat file 822,and inserts or updates statistics into a call_det_sum table 820. Theupd_stats object 742 reads the records sequentially from theRegNot/QualReq table 720 with the location within the table 720 beingmaintained in a seq_tbl table 812. The upd_stats object 742 uses anNPA-NXX and line range within the records to look up the home company,SID, and switch within a sid_listing2 table 826.

The distmin2 object 748 reads the records from the daily filedmfileMMDD.dat 822 and inserts or updates an entry for each MIN with thelatest registration for that day as a record in a distmin2 table 832.

The system 710 may be implemented with any suitable hardware andsoftware. In the preferred embodiment, the system 710 is implemented ona version 7.22 Informix server running on a six CPU Hewlett-PackardK-570 with 728 MB RAM and version 10.20 of an Operating System. Thestorage for the database is provided by an MTI disk array configuredwith raid level ten protection. Users fall under one of threecategories: parsers that input ANSI-41 switch data, background processesthat provide data summarization support, both utilizing shared memoryconnections to the server, and users that actively query the datathrough one of the interfaces 760 using TCP sockets.

The Informix server has fourteen logical data volumes with sixsupporting the server instance for the master database, physical andlogical logs, and sorting. The eight remaining volumes are assigned tothe database supporting the VISION application. Seven of these eightvolumes are reserved for the ANSI-41 messages and are isolated for tablefragmentation. The remaining volume is used to store reference andsummarization tables.

The database is non logged ANSI isolation level dirty read. Backups areperformed at 1:00 am utilizing SQL unload scripts, each backup cycleunloads the previous day's data and creates the next day's fragment. Inthe event of system failure recovery can be as granular as a single dayto the full historical data volume. Upon completion of a system restorethe current days data feeds are reprocessed up through currentreal-time. The backup system is designed to achieve the best balancebetween transaction performance and recoverability.

Catcher Processes

A more detailed description of the catcher 712 will now be provided withreference to FIGS. 15 to 18. As discussed above, a data capture device30 may capture data from a variety of sources, such as from the linkcapture device 32, or the STP capture device 34. The processing thatoccurs when data is capture by the link capture device 32 differs fromthe processing that occurs when data is captured from the STP capturedevice 34. An explanation will first be given as to the processing thatoccurs when data is captured over the link capture device 32.

With reference to FIG. 15, a catcher parent process 840 is started at841 and waits for a client connection to occur at 843. At 845, thecatcher 712 checks whether the initial connection contains a valid ID.As discussed above with reference to FIG. 7B, each transmission from thelink capture device 32 includes a header having an STS ID as well asother information. The catcher 712 determines whether that STS ID is avalid ID and, if it is not, it rejects the connection as invalid at 847and then returns to 843 and waits for the next client connection. If theID is valid, then at 849, the catcher 712 determines whether aconnection has already been established for that ID. If a connection hasbeen established, then at 851 the catcher 712 rejects the connection asbeing a duplicate feed and returns to 843 and enters a wait state. If noconnection has been established, then at 853, the catcher 712 spawns achild catcher process for that ID.

An operation of a catcher child process 860 is shown in FIG. 16. Thecatcher child process begins at 861 and at 862 reads incoming data froma client feed. At 863, the catcher 712 determines whether the data is areject record, and, if it is, writes the record to the reject file 716at 865. If the data is not a reject record, then the catcher 712 nextdetermines whether the data is a registration notification record at864. If the data is a registration notification record, then at 866 thecatcher 712 writes the record to the RegNot file 714 at 866. At 867 thecatcher 712 determines whether there are any more records in the memoryto compare. For the first message, the catcher 712 does not have anymore messages to compare and turns to 868 and determine whether therecord has been paired. As discussed above, certain of the ANSI-41messages can be paired together as a set of “invoke” and “return”messages. If the record is not paired, then at 869 the record is writtento a memory buffer and processing returns to a wait state at 862. Whenrecords exist in memory to compare, then at 870 the catcher 712determines whether the record matches a corresponding record in thebuffer memory at 870. The catcher 712 determines whether a match existsby comparing the destination point code (DPC), origination point code(OPC), and transaction ID (TRANSID). If a match exists, then at 873 thecatcher 712 writes the paired record to the daily file 718. The visioncatcher 712 then returns to 867 to check whether any additional recordsexist in memory to compare.

If the record does not match a corresponding record in buffer memory,then at 871 the catcher 712 determines whether the buffer record hasexceeded its time-out value. If the time-out value has not beenexceeded, then the vision catcher 712 returns to 867 to determinewhether any more records exist in the memory. The time-out period isimplemented to prevent records from remaining in the buffer memoryindefinitely. If the time-out value has been exceeded, then at 872 thecatcher 712 determines whether the record is an invoke message. If themessage is an invoke message, then at 875 the catcher 712 writes therecord to the daily file 718 as an unpaired record and at 874 the recordis deleted from the buffer memory. The return message is not written tothe daily file 718 since by itself it does not contain enough of thecritical information used by the system 710. In other applications ofthe system 710, however, the return message may contain information thatis useful and may alternatively be written to the daily file 718 afterits time-out value has been exceeded.

An STP catcher parent process 880 which is performed by the visioncatcher 712 when receiving data from the STP capture device 34 will nowbe described with reference to FIG. 17. The STP catcher parent processbegins at 881 and at 883 the catcher 712 waits for one of the STP datacollectors 34 to connect. At 885, the catcher 712 determines whether theinitial connection contains a valid header. As discussed above withreference to FIG. 15, the header of a data transmission includes an ID,such as an STS ID which the catcher 712 reads to determine whether theheader is valid. If the header is not valid, then at 887 the catcher 712rejects the connection as invalid and returns to a wait state at 883. Ifthe connection has a valid header, then at 889 the parent process spawnsa child catcher for that STP data-collector connection.

With reference to FIG. 18, an STP catcher child process 890 begins at891 and at 892 the catcher 712 reads its point code list. The point codelist file contains all of the home networks point codes for filteringduplicate messages. The point code list is used for two reasons: one isto determine which messages to capture from the STP and the second is toeliminate receiving duplicate messages caused by inter-companymessaging. At 893, the catcher 712 waits for incoming data from a clientfeed. At 894, the catcher 712 determines whether the MTP and SCCP layershave been successfully parsed. The data coming from an STP pair iscoming from a higher level than data off the SS7 network from one of thedata capture devices 32. As a result, the network layers ofcommunications need to be removed. If the network layer parse wasunsuccessful, then at 895 the record is dropped and the catcher 712writes the message to an error log. If the network parse layer parse wassuccessful, then at 896 the catcher 712 checks whether the OPC and/orDPC are in the STP point code list. If one of them is in the STP pointcode list, which is determined by the catcher 712 with reference to theSTP point code list file, then at 897 the catcher 712 checks whether therecord is a reject record. If the record is a reject record, then at 900the catcher 712 writes the record to the reject daily file 716. If therecord is not a reject record, then at 898 the catcher 712 determineswhether the record is registration notification. If the record is aregistration notification, then the catcher 712 writes the record to theRegNot file 714. If the record is neither a reject record nor aregistration notification record, then the catcher 712 writes themessage to the STP daily file 718 at 899.

Pairing

A process 912 of pairing records from the STP daily file 718 will now bedescribed with FIG. 19. The process 910 begins at 911 and at 912 apairer 727 reads from an STP daily file 725 and determines at 913whether any more records exist in memory to compare. If no more recordsexist to compare and, as determined at 914, that the record was notpaired, then at 915 the pairer 727 writes the record to the buffermemory and returns to 912 for reading the next entry in the STP dailyfile 725. If additional records exist in memory to compare, then at 916the pairer 727 checks whether the record matches a corresponding recordin the buffer memory by comparing the DPC, OPC, and TRANSID of therecords. If a match exists, the pairer 727 writes the paired record tothe daily file 718. If the record does not match a record in the buffermemory, then at 917 the pairer 727 checks whether a time out value hasbeen exceeded. If the time out value has been exceeded, then at 918 thepairer 727 checks whether the message is an invoke message and, if itis, writes it to the daily file 718 as an unpaired message at 921. Afterthe record has been written to the daily file 718, the pairer 727deletes the record from the buffer memory at 920.

Parsing

A method 930 of parsing the data will be described with reference toFIGS. 20 to 22. The parsing process 930 begins at 931 and at 932 theparser 726 determines whether there is a last byte file and creates oneif there is not at 933. At 935, the parser 726 determines whether thedaily file 718 contains any data to read. If no data exists in the dailyfile to read, then at 934 the parser 726 checks whether the day hasadvanced and updates the last byte file and opens a new daily file if ithas at 936. When the daily file 718 contains data to be read, the parser726 reads the data and determines whether it contains valid headerinformation at 937. If the header information is not valid, then at 938the parser 726 attempts to resync the daily file 718 and determineswhether the resyncing was successful at 938. If it was not successful,then at 940 the parser 726 logs the error and exits. If the resyncing,on the other hand, was successful, then the parser 726 returns to 935and checks whether any data needs to be read from the daily file 718.

If the header information is valid, then at 939 the parser 726 parsesthe TCAP information and determines whether the parse was successful. Ifthe parse was unsuccessful, then the parser 726 attempts to resync thedaily file 718 at 938. If the TCAP information was successfully parsed,then at 941 the parser 726 parses the message parameters and determineswhether the parse was successful. If the parse was not successful, thenat 942 the parser 726 logs the bad parameter and continues at 943 tocreate a database insert statement. At 944, the parser 726 determineswhether the insert statement has been successfully stored on thedatabase 740. The insert record is actually stored in the message table806 or RegNot/QualReq table 720 dedicated for the particular message inthe data record. Consequently, the system 710 stores like messages incommon message tables 806. If the insert was unsuccessful, then at 947,the parser 726 determines whether the record is a duplicate, and, if itis not, logs the error and exits at 940. If the record was a duplicate,then at 946 the parser 726 saves the duplicate record in statisticalinformation. After saving the duplicate record at 946 or after asuccessful placement of an insert record into the database 740, theparser 726 updates the statistical information and the last byte file at945. The parser 726 then returns to 935 to determine whether the dailyfile 718 contains any data to be read.

FIG. 21 illustrates a process in which the parser 726 determines whetherthe message parameters have been successfully parsed at 941. The parsingof the message parameters begin at 951 and at 952 the parser 726determines whether any parameters exist to be read. If no parametersexist, then at 953 the process terminates. If parameters do need to beread, then at 954 the parser 726 reads the parameter ID byte anddetermines at 955 whether the ID byte is valid. If the ID byte isinvalid, then at 956 the parser 726 logs the bad parameter ID andreturns to 954 to read the parameter ID byte. If the ID byte is valid,then at 957 the parser 726 reads the parameter length and at 958determines whether the length is valid. If the length is invalid, thenat 959 the parser 726 logs the bad parameter length value and returns to954 to read the parameter ID byte. If the ID length is valid, then at960 the parser 726 attempts to parse a particular parameter for thatmessage. If the parameter is valid, as determined at 961, then theparser 726 returns to 952 to determine whether any other parameters needto be read. If the parameter is invalid, then at 962, the parser 726logs the bad parameter and returns to 954 to read the next parameter IDbyte.

FIG. 22 illustrates a flow chart by which the parser 726 determines at944 whether the INSERT record has been successfully placed into thedatabase 740. The parser begins at 971 and at 972 creates an INSERTbuffer statement for that particular message type. At 973 the parserdetermines whether the PREPARE has been successful and, if it was not,logs the database error and exits at 974. If the PREPARE was successful,then at 975 the parser 726 attempts to FLUSH into the general table andat 976 determines whether the FLUSH was successful. If the FLUSH wasunsuccessful, then at 977 the parser 726 determines whether the FLUSHwas a duplicate, and, if not, logs the database error and exits at 974.If it was a duplicate, then at 979 the parser 726 updates the duplicatestatistical information and at 980 determines whether there is more thanone row left to FLUSH. If not, the parser 726 terminates at 981 andotherwise recreates an INSERT buffer with the remaining rows at 982.

If the FLUSH was successful as determined at 976, then at 978 the parser726 creates an INSERT buffer for the message type tables. As discussedabove, the INSERT is generated for one of the message tables 806 ₁ to801 _(N) or RegNot/QualReq table 720. At 983, the parser 726 determineswhether the PREPARE was successful, and if not, logs the database errorand exits at 984. If the PREPARE was successful, then at 985 the parser726 performs a FLUSH into the message table 806. If the FLUSH wassuccessful, as determined at 986, the parser 726 terminates at 987,otherwise, the parser 726 logs the database error and exits at 984.

A process 990 of parsing records from the reject file 716 will now bedescribed with reference to FIG. 23. The reject parser 724 begins at 991and at 992 determines whether there is a last byte file. If not, thereject parser 724 creates a new last byte file at 993. After the lastbyte file has been created or if there already was one, then at 994 thereject parser 724 determines whether the reject file 716 contains anydata to be read. If no data exists, then at 995 the reject parser 724determines whether the day has advanced. If the day has advanced, thenat 996 the reject parser 724 updates the last byte file and opens a newdaily reject file 716 at 996.

When the reject daily file 716 contains data to be read, the rejectparser 724 at 997 reads the header information and determines whether itis valid. If it is invalid, then at 998 the reject parser 724 attemptsto resync the file 716 and checks whether the resyncing was successful.If the resyncing was unsuccessful, then at 999 the reject parser 724 logthe error and exists. If the resyncing was successful, then the rejectparser 724 returns to 994 to read the data from the reject daily file716.

If the header information is valid, then at 1001 the reject parser 724attempts to parse the TCAP information and checks whether the parsingwas successful. If the parsing was unsuccessful, the reject parser 724attempts to resync the file 716 and determines at 998 whether theresyncing was successful. If the TCAP information was successfullyparsed, then at 1002 the reject parser 724 attempts to parse the ANSI-41parameter set and checks whether that parse was successful If theparsing was unsuccessful, then at 1003 the reject parser 724 logs thebad parameter and continues at 1004 to create a database UPDATE/INSERTstatement. At 1005, the reject parser 724 attempts to place the UPDATErecord into the call_detail2 table 804 and determines whether the recordwas successfully placed. If it was not, then at 1006 the reject parser724 determines whether the record was a duplicate and, if it was not,logs any error and exits at 999. The reject parser 724, at times, willnot be able match the reject message with a message in the database 740and will have to wait for a subsequent operation of process 990 to matchthe reject message. If the record was a duplicate, then at 1009 thereject parser 724 saves the duplicate record as statistical informationin a reject statistical file in the database 740 and returns to 994 todetermine whether the reject daily file 716 has any data to be readfrom.

If the UPDATE record was successfully placed in the call_detail2 table804, then at 1007 the reject parser 724 attempts to place the UPDATErecord into one of the message tables 806 dedicated for reject messages.If the reject parser 724 was successful in placing the UPDATE recordinto the message tables 806, then at 1010 the reject parser 724 attemptsto UPDATE/INSERT the record into the reject statistical file in database740. At 1011, the statistical information is updated and the last bytefile is updated. If the UPDATE record was unsuccessfully placed into themessage table 806, then at 1008 the reject parser 724 logs the error andexits.

Updating Statistics

A process 1020 performed by the Upd_Stats object 742 will now bedescribed with reference to FIG. 24. In general, the Upd_Stats object742 selects records from the RegNot/QualReq table 720, may acquireadditional information from the sid_listing2 table 826, and inserts orupdates information in the call_det_sum table 820. The process 1020begins at 1021 and at 1022 the Upd_Stats object 742 selects the lastread sequence number from the sequence table Seq_Tbl 812. At 1023, theUpd_Stats object 742 determines whether a new record exists in theRegNot/QualReq table 720 with the next sequence number. If no recordexists, then at 1024 the Upd_Stats object 742 sleeps for a period oftime, such as a second, and then repeats 1023 to determine whether therecord now exists. When a record does exist in the RegNot/QualReq table720 with the correct sequence number, then at 1025 the Upd_Stats object742 determines whether a home SID and company or home region can bedetermined from the NPA-NXX-XXXX information in the record. TheUpd_Stats object 742 performs a look-up function in the sid_listing2table 826 to find the home SID and company or the home region. If thisinformation cannot be determined, then at 1030 the Upd_Stats object 742updates the sequence number in the sequence table Seq_Tbl 812. If theinformation on the home SID and company or home region can bedetermined, then at 1026 the Upd_Stats object 742 determines whether aserving company or home region can be determined from the MSCID. TheUpd_Stats object 742 derives the serving company and home region frominformation in the sid_listing2 table 826. If this information isunavailable, then at 1030 the Upd_Stats object 742 updates the sequencenumber in the sequence table Seq_Tbl 812. If the information isavailable, then at 1027 the Upd_Stats object 742 writes a record to thedmfileMMDD.dat file 822. The dmfileMMDD.dat file 822 contains all therecords already tested for STATS and are ready to be used by thedistmin2 object 748. At 1028, the Upd_Stats object 742 attempts toINSERT/UPDATE information in the call_det_sum table 820 and determineswhether this action was successful. If it was not, then at 1029, theUpd_Stats object 742 logs the error and exits. If it was successful,then at 1030 the Upd_Stats object 742 updates the sequence number in theSeq_Tbl 812.

The call_det_sum table 820 contains fields for the home company, homeSID, home switch, serving company, serving SID, OPC, DPC, TRANSID,message type, date time, STATS, and message errors. Some of thisinformation, as discussed above, is obtained by the Upd_Stats object 742from the sid_listing2 table 826. The STATS in the call_det_sum table820, in this example, may fall into one of four categories. The categoryof “valid” indicates that the paired record has a valid return and meansthat no error or authorization denied information accompanies thismessage. The category of “invalid” means that the paired record has aninvalid return and that there is an error in or authorization deniedassociated with that message. A third category is “unpaired” meaningthat the record did not have a return and the status is consequentlyunknown. The fourth category is a “reject” category which is handled bythe reject parser 724.

Distinct MIN

A process 1040 performed by the distmin2 object 748 will now bedescribed with reference to FIG. 25. The process 1040 begins at 1041 andat 1042 the distmin2 object 748 determines whether there is a last bytefile. If not, the distmin2 object 748 creates the last byte file at1043. At 1044, the distmin2 object 748 waits for data to be read fromthe dmfileMMDD.dat table 822. When there is new data to be read, thedistmin2 object 748 reads the RegNot record written by the Upd_Statsobject 742. At 1046, the distmin2 object 748 attempts to update thedistmin2 table 832 when the time associated with the new record is morerecent than any record in the distmin2 table 832 associated with thatparticular MIN. The distmin2 object 748 also determines whether theupdate was successful at 1046, and, if it was not, determines whetherthere was an error from the database. If there was, the distmin2 object748 logs the error and exits at 1048. If there was no error from thedatabase, then at 1049 the distmin2 object 748 attempts to place aninsert record as a new RegNot in the distmin2 table 832. If this newRegNot record was successfully placed in the distmin2 table 832, thenthe distmin2 object 748 updates statistical information and the lastbyte file at 1051. If the distmin2 object 748 was unsuccessful inplacing the RegNot record into the distmin2 table 832, then the distmin2object 748 checks whether there was an error from the database at 1050and logs the error and exits at 1048 if there was such an error.

The distmin2 table 832 has an entry for every MIN encountered during aday. The distmin2 table 832 preferably contains the fields of the MIN,home SID, serving company, the serving SID, the serving switch, themessage type, the date, the time, DPC, the OPC, and the NPA-NXX. Asdiscussed above, the distmin2 object 748 checks the time of the entry ofthe distmin2 table 832 and compares that to the time of a new record inthe dmfileMMDD.dat file 822. The distmin2 object 748 only updates thedistmin2 table 832 when the new record is more recent than that storedin the distmin2 table 832 for a particular MIN.

Graphical User Interface

As described in the summary of the invention, information from themessages provides roamer visibility, fraud, and other usefuladministrative data. This data is available for query by on-linecustomer support work stations as well as other personnel. This data, asmentioned in the summary of the invention, can be processed to createvarious statistics relevant to network traffic, network engineering,customer support, and marketing. The interfaces 760 to the system 710provide personnel with this query capability.

A process 1060 by which personnel gain access to the system 710 throughone of the interfaces 760 will now be described with reference to FIG.26. A graphical user interface, (“GUI”) begins at 1061 and at 1062 theinterface 760 prompts the user for a password. Upon successful login asdetermined by the system 710 at 1063, the system 710 next checks whetherthat login name is already in a session at 1064. If the login name isalready in a session, then the system 710 displays a message to the userthat the user is already logged on at 1066 and processing returns to1062 at which the time the user is prompted for a password. If the loginname is not already in a session, then the system 710 checks whether thepassword has expired at 1065. If the password has expired, then at 1067the user is required to change the password and to continue the loginprocedure at 1062. If the password has not expired then the system 710displays a main screen at 1068.

An example of a Graphical User Interface 1200 is shown in FIG. 27. FIG.27 depicts a main menu 1240 having a tool bar 1250, a header section1260, and a results area 1270. In this example of the GUI 1200, the toolbar 1250 includes an icon 1241 for a MIN/ESN query, an icon 1242 for anactive roamer query, an icon 1243 for a switch-to-switch query, an icon1244 for a transaction statistics query, an icon 1245 for printing thequery results, and an icon 1246 for on-line help. The tool bar 1250 isnot limited to these icons but may include additional icons for othertypes of queries.

The header section 1260 varies according to the query selected. In theexample shown in FIG. 27, the MIN/ESN icon 1241 was selected for aMIN/ESN query. Consequently, the header section 1260 displays theMIN/ESN header 1262. The result section 1270 contains all entriessatisfying the search parameters of one of the queries.

MIN/ESN Query

One of the queries available to a user of the system 710 is a MIN/ESNquery. Through a MIN/ESN query, the roaming activity of a specificcustomer can be seen. As shown in more detail in FIG. 28, the MIN/ESNheader 1262 includes a field 1282 for entering the MIN, a field 1284 forentering the ESN, and a field 1286 for entering a date. The user entersone of or both of the MIN and ESN and also provides date information infield 1286. To execute the query, the user selects the “Run Query”button 1289 and can cancel the query at any time by pressing the “CancelQuery” button 1285. The user may specify the date in one of two ways, byspecifying an exact date or by indicating a range of dates. To limit thequery to one single date, the user selects the date within field 1286and clicks on the exact date field 1288. On the other hand, to perform aquery on a range of dates, the user selects the starting date withinfield 1286 and leaves the exact date field 1288 unmarked whereby thequery will pull all records from the date specified in field 1286 to thepresent date.

A process 1070 of performing a MIN/ESN query will now be described withreference to FIGS. 29A and 29B. The process 1070 begins at 1071 and at1072 the system 710 receives the MIN and or ESN along with datainformation at 1072. The system 710 creates statements for PREPARE/OPENESQL/C commands at 1073 and checks whether the PREPARE/OPEN wassuccessful at 1074. If it was unsuccessful, then the process 1070returns to 1072 so that the user may reenter the MIN and/or ESN and datainformation. If the PREPARE/OPEN was successful, then at 1075 the system710 fetches the first row from the call_detail2 table 804. If the FETCHwas successful, as determined by the system at 1077, then at 1079 thesystem 710 displays the row on a main screen on the interface 760.Subsequent rows are fetched at 1075 and displayed at 1079 until thecomplete set of records satisfying the query are displayed on theinterface 760. If a FETCH is unsuccessful, then at 1078 the system 710checks whether there was a database error. If an error does exist, thenthe system 710 displays an error message to the interface 760, finishesretrieving rows, and returns control to the user at 1076.

A process 1090 by which a user can obtain detailed information forindividual entries in the search results will be described withreference to FIG. 29B. A MIN/ESN detail query begins at 1090 and at 1092the system 710 receives a user selection for a row on the main screen1040. At 1093, the system 710 creates a select statement for one of themessage tables 806 or RegNot/QualReq table 720. At 1094, the system 710determines whether the PREPARE was successful, and, if it is not,displays an error to the user at 1095. If the PREPARE was successful,then at 1097 the system 710 fetches the record from the message table806 or RegNot/QualReq table 720 and fetches all “readable” fields fromthe parameter dictionary at 1098. The system 710 then displays theinformation in a dialog box at 1099 and ends the query at 1096.

An example of the results of a MIN/ESN query is shown in FIGS. 30A to30C. FIG. 30A shows results of a search in section 1270 of a queryinvolving a particular MIN, which was entered into the MIN field 1282,and date, as entered in the date field 1286. Each row within the section1270 is a separate message that contains that MIN and the columns in thesection 1270 provide general information on each message. As discussedabove with reference to FIG. 29B, a user may select a single record inwhich case the record will be shown in a tabular format.

An example of a record detail for a Registration Notification message isshown in FIG. 30B. When the user selects a single record from theresults section 1270, the system 710 pulls all of the parameter datafrom one of the message tables 806 or the RegNot/QualReq table 720. Withreference to FIG. 30B, the GUI 1200 displays the record in a format witha plurality of tabs 1292. In the example shown in FIG. 30B, the“General” tab is selected and many of the general parameters shown in30A are also shown in this tab. To view some of the other parameters,the user simply clicks on one of the other tabs and information groupedunder that tab will be displayed.

The user can also scroll through the messages in the results section1270 with buttons 1295 to 1298. For instance, the user presses the“Prev” button 1295 to view the previous record, the “Next” button 1296to view the next record, the “Print” button 1297 to print the record,and the “Close” button 1298 to close the display 1290 of that particularrecord. If the user is interested in only scrolling through messages ofthe same type, such as all Registration Notification messages, then theuser selects field 1294.

By displaying the parameter data with tabs 1292, the data can be easilyviewed by the user. The user need not scroll through a large amount ofdata to arrive at the data of interest but rather can quickly point to atab 1292 to view all of the information that is desired. Also, thesystem 710 preferably provides a tab 1292 only if a parameter displayedin that tab 1292 contains data. For instance, FIG. 30B does not show anytab for “Authentication” since this record did not contain suchinformation. In contrast, FIG. 30C does include a tab 1292 for“Authentication” since this record does contain such data.

Active Roamer Query

When the user selects the active roamer query icon 1242, the main menu1240 displays an active roamer header, such as header 1263 shown in FIG.31. The header 1263 includes a field 1302 for the serving SID, a field1304 for the home SID, a field 1306 for the switch, and a field 1308 forthe NPA-NXX. The user can structure a query by selecting any one of thefields 1302, 1304, 1306, or 1308 or by entering data into anycombination of the fields 1302, 1304, 1306, or 1308. The system 710 thensearches for all unique registration notification records that areregistered in a serving market but which have not been canceled with aRegistration Cancellation or an MSInactive message and that do not havean authorization denied or error code. The user may also select a field1310 to show all registrations. With this field 1310 selected, allunique registrations, whether or not they have been canceled with aRegistration Cancellation message, are shown. In this example, thesearch is performed only for the current day, although in otherapplications of the invention, day or range of dates may be entered bythe user.

A process 1100 of performing an active roamer query will now bedescribed with reference to FIGS. 32A and 32B. The active roamer querybegins at 1101 and at 1102 the user enters the search parameters. Theuser, for instance, may provide the serving SID, switch, home SID, orNPA-NXX information and may also limit to currently registered or allregistration messages. At 1103 the system 710 creates statements forOPEN/PREPARE ESQL/C commands and at 1104 determines whether theOPEN/PREPARE was successful. If it was successful, then at 1105 thefirst row is fetched and at 1106 the system 710 determines whether theFETCH was successful. If the FETCH was not successful, then the system710 determines whether there was a database error at 1107 and, if therewas, displays an error message to the user on the interface 760 at 1110.If there was no database error, then the system 710 at 1108 finishesretrieving rows and returns control to the user. If the FETCH wassuccessful, then at 1109 the system 710 determines whether aregistration cancellation, MSInactive, authorization denied, or errormessages have been received at 1112. The current record is displayed at1111 and the system 710 fetches the next row at 1105.

As with the search results from a MIN/ESN query, the results of theactive roamer query will be displayed in the section 1270. An example ofsearch results for an active roamer query is shown in FIG. 31B. In thisexample, the search was performed between serving SID 34 and home SID24. Also, the search included all registrations. From the results of asearch, the user may double click on any entry in order to receive allof the detailed information associated with that message.

A process 1120 by which the system 710 displays and retrieves thisinformation for the user will now be described with reference to FIG.32B. An active roamer detail query begins at 1121 and at 1122 the userselects a row from the main menu 1240. At 1123, the system 710 creates aSELECT statement for one of the message tables 806 or for theRegNot/QualReq table 720 and checks at 1124 whether the PREPARE wassuccessful. If not, at 1125 the system 710 displays an error to the userand ends the query at 1126. If the PREPARE was successful, then at 1127the system 710 fetches the record from the message table 806 orRegNot/QualReq table 720 and fetches all “readable” fields from theparameter dictionary at 1128. The system 710 then displays theinformation in a dialog box with tabs at 1129 and ends the query at1126.

Switch-to-Switch Query

If the user selects the switch-to-switch icon 1243, then the header 1260will display the switch-to-switch header, such as switch header 1264 asshown in FIG. 33A. The switch-to-switch query allows a user to searchANSI-41 messaging on one switch or between two switches. The header 1264includes a field 1320 for the OPC, a field 1322 for the DPC, and a field1324 for a date. The header 1264 also includes a field 1326 which allowsa user to select either an exact date or a range of dates from the dateindicated in field 1324 to the present date. The user selects a “RunQuery” button 1327 to initiate a query and presses a “Cancel Query”button 1328 to end the query.

A process 1130 of performing a switch-to-switch query will now bedescribed with reference to FIGS. 34A and 34B. A switch-to-switch querybegins at 1131 and at 1132 the user provides the OPC and/or DPC alongwith a date. At 1133 the system 710 creates statements for PREPARE/OPENESQL/C commands and at 1134 determines whether the PREPARE/OPEN wassuccessful. At 1135, the system 710 fetches the first row and at 1137determines whether the FETCH was successful. If the FETCH was notsuccessful, then at 1138 the system 710 checks whether there was adatabase error and, if there was, displays an error message to theinterface 760 at 1140. If there was not a database error, then at 1136the system 710 finishes retrieving the rows and returns control to theuser. If the FETCH was successful, then at 1139 the system 710 displaysthe record on the main menu 1240 with the results section 1270. Thesystem 710 then returns to FETCH the next row at 1135.

As with the MIN/ESN and active roamer queries, the user may double clickon an entry in the results section 1270 to view a detailed record of allparameters in that message. An example of search results from aswitch-to-switch query is shown in FIG. 33B. In this example, the searchwas performed between OPC 001-151-101 and DPC 001-151-126 from Dec. 2,1997, to the present date, which was Dec. 2, 1997.

A process 1150 of performing a detailed switch-to-switch query begins at1151 and at 1152 the user selects a record from the results section1270. At 1153 the system 710 creates a SELECT statement for thecorresponding message table 806 or RegNot/QualReq table 720 and at 1154determines whether the PREPARE was successful. If it was not, then at1155 the system 710 displays an error to the user and ends the query at1159. If it was successful, then at 1156 the system 710 fetches all“readable” fields from the parameter dictionary at 1157 and displays theinformation in a dialog box with tabs at 1158.

Statistical Query

When the user selects the transaction statistics icon 1244, the GUI 1200provides a transaction statistics window 1340. The transactionstatistics queries provide information about registration notificationand some qualification request messages between two cellular serviceproviders. With reference to FIG. 35A, a transaction statistics window1340 includes a section 1342 for selecting either information on“roaming” or information on “serving.” The roaming information providesdata on a service provider's own subscribers which are roaming in othernetworks whereas the serving information provides data on all customerswithin the home service providers network. In this example, the homenetwork is shown as BellSouth Cellular Corporation (“BSCC”), althoughthe invention may be used by any type of service provider.

The transaction statistics window 1340 also includes a field 1344 for aregion within the home network, a field 1346 for a SID, a field 1347 fora switch, a field 1348 for the NPA-NXX, and a field 1350 for the MIN. Onother service providers, the transaction statistics window 1340 includesa field 1354 for the company, a field 1356 for a SID, a field 1358 for aswitch, a field 1360 for the NPA-NXX, and a field 1362 for the MIN. Thetransaction statistics window 1340 also includes a field 1364 forchecking destination point codes only from the GTE Clearinghouse. Whenfield 1364 is checked, the system 710 only shows messages sent to theGTE Clearinghouse destination switch. A “Run Query” button 1366 is usedto initiate a query and a “Cancel Query” button 1368 is used to stop aquery. A “Close” button 1372 allows the transaction statistics window1340 to be closed, a “Print” button 1374 allows the results of a queryto be printed, and a “Help” button 1376 provides on-line help. Theresults of a query are displayed in the results section 1380.

A process 1160 of performing a transaction statistics query will now bedescribed with reference to FIGS. 36 to 38. A statistical query beginsat 1161 and at 1162 the user provides information on the parameters forthe query. The user may provide information on any one or anycombination of the date, roaming or serving context, home company,serving company, home SID, serving SID, home switch, roaming switch,NPA-NXX, and MIN. The fields in the transaction statistics window 1340are organized in an order from less specific to more specific. The usermay search on a high level from a region to a company or may perform adetailed query on a specific MIN or NPA-NXX. These different levels ofsearching capability make it possible for the user to have a very broador a very specific search, depending upon the needs of the user.

At 1163, the system 710 determines whether the user has manually entereda SID, NPA-NXX, or a MIN. If the user has, then at 1167 the system 710populates the other fields by performing a look-up function in thesid_listing2 table 826. If there was an error in retrieving the look-upinformation, as determined at 1168, then the system 710 displays anerror and allows the user to continue or retry the query at 1169. Ifthere was no error, then at 1170 the system 710 displays the informationin the fields above the one receiving information from a user. Forinstance, if the user enters a particular NPA-NXX, the system 710performs a look-up in its sid_listing2 table 826 to determine whatcompany or region serves that NPA-NXX and which SID is associated withthat NPA-NXX. The system 710 then retrieves this information from thesid_listing2 table 826 and populate those fields with the data.

The user can also perform a look-up function and select an appropriatechoice from a listing of available choices. For instance, at 1164 thesystem 710 determines whether the user has dropped down the list on acategory, such as when the user selects the list for all companies infield 1354. At 1171, the system 710 performs a look-up function performsa look-up function in the sid_listing2 table 826 and populates theselection with the available choices. If an error occurs during thelook-up, as determined at 1172, then an error is displayed and the useris allowed to continue or retry the query at 1173. If there was noerror, then at 1174 the choices available to the user are displayed.

If the user double clicks in a result area, as determined at 1165, thenthe 710 determine whether the results are already at the MIN level. Ifthe results are at the MIN level then at 1176 the system 710 pulls upthe MIN/ESN query and automatically runs that query. If it is not at theMIN level, then at 1177 the system 710 performs a query with thecurrently selected value in the result area. For instance, if a querywas first performed against all companies, the results section 1380 maycontain records from a plurality of different companies. If the userthen double clicks on a particular company within the results section1380, the system 710 populates the field 1354 with the selected company,performs that query, and displays the results in the section 1380. Eachtime that a more detailed field is selected, the system 710 limits thequery to the selected values and performs that query. If the MIN isselected in the results section 1380, however, the system 710 goes tothe MIN/ESN query and performs that query with the selected MIN.

If the user has “traversed” the queries, as determined at 1166, then thesystem 710 next determines whether only the values have been changed at1178. If only the values have been changed, then at 1179 the system 710changes the values in the criteria fields without rerunning the entirequery. On the other hand, when it is not just the values that arechanged, the system 710 changes that criteria values and runs the queryfor that scenario at 1180.

A process 1190 of performing a company/SID level query will now bedescribed with reference to FIG. 37. The process 1190 begins at 1191 andat 1192 the system 710 builds an AGGREGATE query using the user-selectedcriteria entered into the fields. At 1193 the system 710 performs anOPEN/PREPARE and determines whether it was successful. If not, thesystem 710 returns an error message to the GUI 1200 at 1195. If it wassuccessful, then at 1194 the system 710 fetches the first row from thedatabase and determines at 1196 whether the FETCH was successful. If itwas successful, then at 1198 the system 710 returns the record to theGUI 1200. If the FETCH was unsuccessful, then at 1197 the system 710determines whether it was the last row, and if it was, the system 710returns the row to the GUI at 1199. If it was not the last row, then at1195 the system 710 returns an error message to the GUI 1200.

A process 1210 of performing a statistical query at the NPA-NXX/MINlevel will now be described with reference to FIG. 38. The process 1210begins at 1211 and at 1212 the system 710 builds an “inner” loop query.The process 1210 involves both the use of “inner” and “outer” loops. The“inner” and “outer” loops are generic for the types of nested queriesperformed by the process 1210. For instance, a query for all NPA-NXXsroaming a particular serving company requires an outer loop for allNPA-NXXs but also an “inner” loop for all SIDs in that company. Theregistration notification messages do not contain the serving companyinformation whereby the system 710 must perform a loop on just the SIDs.

At 1213 the system 710 performs a PREPARE for the inner loop anddetermines whether it was successful. If it was not, then at 1214 thesystem 710 returns an error message to the GUI 1200. If it wassuccessful, then at 1215 the system 710 builds an outer loop query andat 1216 performs a PREPARE/OPEN and determines whether it wassuccessful. If it was not, then the system 710 returns an error messageto the GUI 1200 at 1214. If it was successful, then at 1217 the system710 fetches the first row from the outer query and determines at 1218whether the FETCH was successful. If it was not, the system 710 nextdetermines whether it was an outer FETCH error at 1219 and returns anerror message to the GUI 1200 at 1214 if it was an outer FETCH error.

If the outer FETCH was successful, then the process 1210 involves goingthrough the inner loop based on the record fetched with the outer loop.With reference to FIG. 38, at 1220 the system 710 prepares an OPEN andFETCH for the first or next row from the outer query and determines at1221 whether the inner FETCH was successful. If it was not, then at 1222the system 710 determines whether it was an inner error and if it was,returns an error to the GUI 1200 at 1214. If the inner FETCH wassuccessful, then at 1223 the fetched row which satisfies both the innerand outer loops is returned to the GUI 1200.

Some examples of transaction statistics queries are shown in FIGS. 35Bto 35F. In the example shown in FIG. 35B, a query was performed on allsubscribers roaming in all foreign markets. The column under “HomeCompany” lists all of the various regions within the BSCC and the columnunder “Serving Company” lists all of the companies serving BSCCsubscribers. The results of this query also indicate all RegNotsmessages, and status of each message, such as whether it was valid,invalid, unpaired, or a reject. A user can drill down from the resultsshown in FIG. 35B and focus in all roaming subscribers of BellSouthMobility Incorporated (BMI) in Region 1 which are roaming in BMI Region2. The results of such a query are shown in FIG. 35C. The query may beeven more limited, such as the query shown in 35D by restricting thequery from home SID 24. An even more restricted search is shown in FIG.35E in which the serving SID is limited to a particular value. As shownin FIG. 35F, the user can even drill down further by limiting the queryto a particular NPA-NXX. Through the transaction statistics query, theuser can therefore structure the query to a level of detail that isdesired.

The entries in the results section of a transaction statistic query arepreferably color coded. The reject records are preferably displayed as ared row in the results section to highlight these records to the viewer.Additionally, the unpaired records are preferably displayed in blue toseparate these records from all other records.

Sample Records

As discussed above, each message is displayed in a tabular format witheach tab containing a set of parameters commonly grouped together. Someexamples of various records are shown in FIGS. 39 through 41. Theinvention, of course, is not limited to these particular messages oreven to this particular grouping of parameters but instead encompassesall message types. An example of the record details for anAuthentication Failure Report is shown in FIGS. 39A to 39C. When the“General” tab is selected, the parameters of general interest aredisplayed to the user in the GUI shown in 39A. If the user selects the“System” tab, then the parameters disclosed in FIG. 39B may bedisplayed. Additionally, the user may select the “Authentication” tab toreceive the authentication data shown in FIG. 39C. In the example shownin FIG. 39C, the Authentication Failure Report message indicates areport type of an RANDC mismatch.

Customer service, technical support, or engineering support can rely onthe data within a record detail to quickly and easily identify a problemthat a particular customer may be encountering. The system 710 providesa quick and easy method of identifying the source of a problem and doesnot require the service provide to put any type of “sniffer” at aswitch. Moreover, the messages are stored on a daily basis and are keptfor preferably one week whereby personnel can query to obtaininformation on past events.

Another example of a record detail is shown in FIGS. 40A and 40B. Inthis example, the message is a Feature Request message and shows the“General” parameters in FIG. 40A. As shown in the “Dialed Digits” field,the digits of “*18” were entered in order to activate a roaming request.As shown in FIG. 40B, the “Call Info” tab reveals that the “FeatureResult” was “Successful.”

The data contained within the system 710 and available to the user canbe used for a multitude of purposes. Customer service, for instance, candetermine that a particular user was able to activate a roaming requestfeature request and that it was successfully received.

An example of the record details for a Registration Notification messageis shown in FIGS. 41A and 41B. The “General” parameters of theRegistration Notification message are shown in FIG. 41A and includessuch things as the MIN, ESN, home SID, serving SID, and the OPC and DPC.The “Calling Features” tab displays parameters indicating which featuresa particular user may have available. As shown in the example depictedin FIG. 41B, the calling features include such features as call waiting,call delivery, three-way calling, call forwarding, and priority callwaiting. By viewing the record details, the features available to aparticular subscriber can be easily ascertained, which can be extremelyuseful. For instance, customer support can quickly determine whether asubscriber who is having trouble with three-way calling is authorizedfor such a feature. The service provider therefore would not waste timeand effort in ensuring proper operation of the service provider'snetwork and the subscriber's phone.

Preferences

The system 710 also allows a user to customize the system 710 for thatparticular user. For instance, as shown in FIG. 42A, a user may selectmessages and chose which parameter pages will be associated with them. Auser therefore may be able to customize the system 710 so that only the“General” parameters are displayed or any other tab 1292 or set of tabs1292. In an example shown in FIG. 42B, the message of a RegistrationNotification is selected and its associated parameter pages are listed.The user can then select which one of these parameter pages should bedisplayed during use of the system 710. The user can customize thesystem 710 even further by selecting only certain messages or statuscodes. With reference to FIG. 42C, the user can select only certainmessages and can also select only certain status codes. The system 710will thereafter show only the selected messages to the user and only theselected status codes.

As a further option available to the user, the user can select theformat for displaying the ESN. The user, for instance, can select thedecimal format “DEC” shown in FIG. 42C or may select to view the ESN ina HEX format.

With reference to FIG. 42D, the user also has the ability to customizethe security of the system 710. The user can, for instance, place userrestrictions on the parameters that are viewed, whether the ESN can beviewed, or whether the ESN can be printed. Consequently, some users mayrestricted from viewing parameters. With regard to the ESN, some usersmay be able to view the ESN on the screen but may be unable to print theESN.

Database

In the preferred embodiment, the space on the databases is conserved bycoding information. For instance, rather than identifying a message as a“Registration Notification,” the message is stored as a message IDnumber of “13.” The system 710 then performs a look-up into a messagedictionary table which correlates the message ID number to the messagename. Thus, when displaying information on message “13,” the system 710reads the ID of “13” from the message table, performs a look-up into themessage dictionary table, and displays the message as a “registrationnotification.” As discussed above, other information concerning themessage is also stored in a coded or abbreviated manner. The homecompany, SID, and switch, for instance, are all determined by a look-upfunction with the sid_listing2 table and are not stored in one of themessage tables 806.

The system 710 also provides the user with a greater amount of controlover a query. The system 710, for instance, does not wait until allresults from a query are obtained before displaying them on the screen.Instead, each row or record is displayed after it has been successfullyfetched. The user therefore is able to view the records as they arebeing retrieved and is not forced to wait a significant amount of timebefore the complete set of results is displayed. The system 710 alsoprovides the user with an opportunity to cancel the query after it hasbeen initiated. This ability to cancel a query is advantageous sincesome queries may require a significant amount of processing time beforeall of the results can be displayed. Consequently, if a useraccidentally enters the wrong query, the user can cancel this query inprogress and need not wait for the query to be completed.

The system 710 also holds the results of one query while a second queryis being performed. After a user performs any one of a MIN/ESN query,active roamer query, or switch-to-switch query, the results of thesearch are displayed in the results section. The user can then perform adifferent one of the MIN/ESN query, active roamer query, orswitch-to-switch query and the results are once again be displayed inthe results section. The results from the first query, however, are notlost but instead a user can recall these results into the resultssection by once again selecting the icon for the first type of query.The user can then toggle between the two search results with the resultsbeing shown in the same results section of the display. In other words,the system 710 does not open a new window but instead maintains the datafor the separate queries within the same window.

On-line Help

The system 710 has a standards file for use with on-line help. Acustomer can right-click on an entry and obtain a definition for aparticular entry. This information is obtained directly from thestandard itself, such as from ANSI-41 and is therefore an accuratedefinition of the entry.

Updating Information

The system 710 is able to monitor the SS7 network 701 and upgrade itselfwhen changes to the network 710 occur. The system 710, as discussedabove, includes the sid_listing2 table 826 that correlates certainparameters to company and SID information. When the system 710 detects anew OPC or DPC within a SID, this entry is added to the sid_listing2table 826. The system 710 also monitors and logs any new companies orSIDs. By monitoring these log files and error files, the system 710 canbe upgrade with the most current information.

The forgoing description of the preferred embodiments of the inventionhas been presented only for the purpose of illustration and descriptionand is not intended to be exhaustive or to limit the invention to theprecise forms disclosed. Many modifications and variations are possiblein light of the above teaching.

For example, the invention has been described with ANSI-41 messaging inan SS7 network 701. The invention is not limited to any particularrevision of ANSI-41 but encompasses all data signaling that occurs overthe SS7 network 701. Furthermore, the invention may be suited to datasignaling within other types of communications networks. Some examplesof these other types of communications networks include frame relay andATM networks.

The invention moreover is not limited to these specific queries butinstead encompasses other queries. Since the system 710 stores themessages and parameters associated with these messages, the system 710can return results on any message type of any parameter contained withina message. Thus, for example, some queries may be directed solely tobilling parameters associated with one or more of the parameters.

Other queries may be useful in testing and developing new technologiesthat employ a SS7 network 701. For example, in the development ofCellemetry

, which includes the transmission of data over the control channels in acellular network, the system 710 could be useful in ensuring propertransmission of the data and in monitoring the data. Queries could bestructured to focus in on only those messages or even parameters ofinterest, such as only registration messages or feature requestmessages.

The embodiments were chosen and described in order to explain theprinciples of the invention and their practical application so as toenable others skilled in the art to utilize the invention and variousembodiments and with various modifications as are suited to theparticular use contemplated.

1. A method of monitoring a communications network carrying at leastsignaling information, the method comprising: receiving messages formingpart of the signaling information in the communications network; themessages including initiating messages and return messages sent inresponse to the initiating messages, each initiating and itscorresponding return message forming a message set; storing the messagesin a file; parsing the messages into their constituent messageparameters; storing the messages along with their constituent messageparameters into message tables; receiving a query on the messages;performing the query to locate a set of records satisfying the query;and displaying the set of records.
 2. The method of claim 1, wherein thereceiving comprises receiving the messages over an SS7 network.
 3. Themethod of claim 2, wherein the receiving comprises receiving themessages from at least one STP.
 4. The method of claim 2, wherein thereceiving comprises receiving the messages from an SS7 link.
 5. Themethod of claim 1, further comprising capturing the messages from thecommunications network.
 6. The method of claim 1, further comprisingpairing messages received from an STP.
 7. The method of claim 1, whereinthe messages comprise TCAP messages and the method further comprisesparsing MTP and SCCP layers of the messages.
 8. The method of claim 1,further comprising storing all reject records in a reject file.
 9. Themethod of claim 1, further comprising storing all registration messagesin a registration file.
 10. The method of claim 1, further comprisingmaintaining statistics on the messages.
 11. The method of claim 10,wherein the maintaining comprises maintaining statistics on whether eachmessage is valid or invalid.
 12. The method of claim 10, wherein themaintaining comprises maintaining statistics on whether each message isa reject.
 13. The method of claim 1, wherein the maintaining compriseslooking up network information and storing the network information alongwith the statistics in a statistics file.
 14. The method of claim 1,further comprising storing current registration on each customer in acustomer table.
 15. The method of claim 14, wherein storing comprisesstoring registration information on each MIN in a MIN table.
 16. Themethod of claim 1, further comprising receiving a query on activity of acustomer.
 17. The method of claim 16, further comprising searching allmessages satisfying the query and displaying results of the query. 18.The method of claim 1, further comprising receiving a query on allroamers within a serving market.
 19. The method of claim 18, furthercomprising searching all messages satisfying the query and displayingresults of the query.
 20. The method of claim 1, further comprisingreceiving a query on data signaling at one switch.
 21. The method ofclaim 20, further comprising searching all messages satisfying the queryand displaying results of the query.
 22. The method of claim 1, furthercomprising receiving a query on data signaling between two switches. 23.The method of claim 22, further comprising searching all messagessatisfying the query and displaying results of the query.
 24. The methodof claim 1, further comprising receiving a query on registrationmessages between at least two service providers.
 25. The method of claim24, further comprising searching all messages satisfying the query anddisplaying results of the query.
 26. The method of claim 24, furthercomprising receiving a second query further limiting search parameterson the registration messages between the at least two service providers.27. The method of claim 1, further comprising receiving a command tocancel the query and canceling the query prior to locating all recordsin the daily file satisfying the query.
 28. The method of claim 1,further comprising displaying records of a first statistic differentlythan records of a second statistic.
 29. The method of claim 1, whereinthe storing comprises storing a plurality of days of messages into aplurality of daily files.
 30. The method of claim 1, further comprisingcustomizing the displaying for a user so that only user-selectedmessages are displayed.
 31. The method of claim 1, further comprisingcustomizing the displaying for a user so that only user-selectedparameters are displayed.
 32. The method of claim 1, further comprisingcustomizing the displaying for a user so that only user-selected codesare displayed.
 33. The method of claim 1, further comprising customizingthe displaying to prevent at least one parameter from being displayed.34. A computer-readable medium for storing software for use inperforming a method of monitoring a communications network carrying atleast signaling information, the method comprising: receiving messagesforming part of the signaling information in the communications network;the messages including initiating messages and return messages sent inresponse to the initiating messages, each initiating and itscorresponding return message forming a message set; storing the messagesin a file; parsing the messages into their constituent messageparameters; storing the messages along with their constituent messageparameters into message tables; receiving a query on the messages;performing the query to locate a set of records satisfying the query;and displaying the set of records.
 35. A system for use with acommunications network carrying at least signaling information, thesystem for use in monitoring the signaling information and comprising: aplurality of message tables; a parser for receiving messages and forstoring the messages in the plurality of message tables with messages ofdifferent types being stored in different message tables; wherein theparser additionally separates each message into its constituentparameters and stores the parameters into fields in its respectivemessage tables; a catcher for receiving messages and for storing themessages in a file within a database; the messages forming part of thedata signaling information in the communications network and beingcaptured from the communications network; the messages includinginitiating messages and return messages sent in response to theinitiating messages, each initiating and its corresponding returnmessage forming a message set and wherein the messages received by theparser are messages provided by the catcher.